bad[.]sushis[.]dev

As of July 22, 2026, the domain bad.sushis.dev is flagged for brand impersonation, specifically targeting SushiSwap, a well-known decentralized finance platform. This domain has been identified as a crypto scam and is currently offline. It appears on one security blocklist, specifically PhishDestroy, indicating that it has been recognized as a threat by at least one reputable security service. The domain is registered through Cloudflare, Inc., a common registrar and DNS provider, which can sometimes be indicative of a temporary or disposable infrastructure used by threat actors.

The IP address 104.21.81.47, associated with this domain, is located in the United States and is part of the Cloudflare network (AS13335). This suggests that the domain was likely using Cloudflare's services to mask its true origin or to gain credibility by associating with a trusted provider. The lack of SSL certificate further raises concerns, as legitimate financial platforms typically use SSL to secure their websites. The page title 'Just a moment...' is a generic message often used by Cloudflare during loading or when a site is temporarily unavailable, which may have been the last known state before the domain was taken offline.

The Gridinsoft trust score of 0/100 indicates a very high level of suspicion, as this score is typically reserved for domains with significant malicious activity. Defenders should remain vigilant and ensure that this domain remains blocked in their security systems to prevent any residual or future threats. While the domain is currently offline, it is important to monitor for any signs of reactivation or related malicious activity. Additionally, defenders should educate users about the risks of visiting unverified or suspicious websites, especially those claiming to be associated with SushiSwap or other trusted crypto brands.