swap-sushi[.]co

Analysis on swap-sushi.co, registered through DYNADOT LLC on March 22, 2026, shows a brand‑impersonation campaign targeting SushiSwap. The domain resolves to IP 130.12.180.128, which is geolocated to the Netherlands and attributed to Virtualine Technologies. Hosting infrastructure runs Nginx with OpenResty and PHP, and the site presents a TLS certificate issued by Let's Encrypt (certificate identifier E8). The HTTP response currently returns a 404 Not Found page title, indicating the content is no longer served.

Intelligence from three security blocklists—including PhishDestroy, MetaMask, and SEAL—lists the domain as malicious, and it is also present on three external blocklists. VirusTotal scans show five of ninety‑four security vendors flagging the host as suspicious, while Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious assessment. The domain is classified as a crypto‑scam, consistent with the impersonation of SushiSwap. Nameserver configuration uses ns1.dyna-ns.net and ns2.dyna-ns.net, both typical of DYNADOT services.

Current status is offline, yet the infrastructure artifacts remain observable. Defenders should continue to block the domain at DNS and network layers, monitor for any re‑activation, and add the associated IP and name server pairs to deny lists. Additional scrutiny of traffic to the IP address and correlation with wallet‑related activity is advised, given the crypto‑scam nature of the threat.