install-sushiswap-v3-new[.]pages[.]dev

This domain, install-sushiswap-v3-new.pages.dev, is actively impersonating SushiSwap, a decentralized finance (DeFi) platform, as confirmed by its page title 'SushiSwap V3: Precision Liquidity for DeFi' and the explicit brand target designation. Infrastructure analysis reveals the domain was registered on October 27, 2025, through Cloudflare, Inc., and is currently resolving to the IP address 188.114.96.3, associated with AS13335 (Cloudflare, Inc.) in the United States. The domain employs Cloudflare nameservers (paul.ns.cloudflare.com and shaz.ns.cloudflare.com) and supports modern protocols such as HSTS and HTTP/3, which are consistent with legitimate services but are also frequently leveraged by threat actors to enhance perceived credibility. Security vendor analysis indicates partial detection: six of 94 vendors on VirusTotal have flagged this domain, while it appears on at least one security blocklist (PhishDestroy). The Gridinsoft trust score of 0/100 further corroborates its classification as malicious. The domain remains operational, returning an HTTP 200 status, which suggests active hosting of content. While the exact nature of the phishing mechanism (e.g., credential harvesting, crypto drainer, or fake token distribution) is not yet confirmed due to the absence of deeper content analysis, the combination of brand impersonation, recent registration, and security vendor detections presents a high-risk profile. Defenders should prioritize blocking this domain at the DNS or network level, particularly within environments where DeFi or cryptocurrency-related activities are conducted. Given the use of Cloudflare infrastructure, takedown efforts may require coordination with the hosting provider, leveraging the evidence of brand impersonation and security vendor detections. Monitoring for additional domains using similar naming conventions (e.g., 'install-[brand]-v3') or Cloudflare Pages subdomains may help identify related infrastructure.