api3[.]sushiswap[.]one

This domain is flagged as an elevated-risk brand impersonation threat targeting SushiSwap users through a fraudulent API endpoint. Infrastructure analysis indicates the domain is designed to mimic legitimate SushiSwap API infrastructure, likely to harvest cryptocurrency wallet credentials or facilitate unauthorized transactions. The specific threat involves credential theft and wallet-draining attacks, where victims are tricked into interacting with the malicious endpoint under the false pretense of accessing SushiSwap services. Multiple technical indicators confirm the malicious nature of api3.sushiswap.one. The domain was registered on September 16, 2025, through Dynadot LLC and currently resolves to IP address 172.67.143.233. VirusTotal reports 3 out of 95 security vendors flagging the domain as malicious, while it appears on at least one security blocklist. The page title 'Just a moment...' suggests the use of Cloudflare or similar services to obfuscate backend infrastructure. Trust scores from Scamadviser (46/100) and Gridinsoft (0/100) further indicate high-risk activity. The domain has since been taken offline, but residual DNS records or cached pages may still pose a threat. Mitigation against this type of brand impersonation requires multi-layered defenses. Users should verify domain authenticity by cross-referencing official SushiSwap documentation and avoiding interactions with unofficial API endpoints. Organizations should implement DNS-based blocking for known malicious IPs (e.g., 172.67.143.233) and monitor for newly registered domains containing 'sushiswap' or similar variations. Cryptocurrency wallet users should enable hardware-based authentication and review transaction approvals carefully. Security teams should prioritize monitoring for credential reuse attempts, particularly from users who may have interacted with the domain prior to its takedown.