sushi-com[.]pics

This domain is flagged as a brand impersonation threat targeting SushiSwap, a decentralized finance platform. Analysis indicates the domain was designed to deceive users by mimicking the legitimate SushiSwap interface, likely to harvest credentials, private keys, or facilitate fraudulent transactions. The use of a misleading page title, 'Google,' suggests an attempt to evade detection by appearing as a benign or unrelated service while executing malicious activities. Infrastructure analysis reveals concrete indicators of compromise. The domain sushi-com.pics was registered on October 31, 2025, through Dynadot LLC, a registrar frequently associated with high-risk domains. It resolves to the IP address 142.250.184.228, which belongs to Google’s infrastructure, a tactic often employed to blend malicious traffic with legitimate services. Security vendors on VirusTotal flagged the domain, with 4 out of 95 engines detecting it as malicious. Additionally, the domain appears on one security blocklist and is currently offline, though its prior activity remains a concern. Users who visited sushi-com.pics should take immediate action to mitigate potential risks. First, revoke any permissions granted to the site in browser wallets or decentralized applications. Second, scan local devices for malware or unauthorized extensions that may have been installed. Third, monitor financial accounts and transactions for unauthorized activity. If credentials or private keys were entered, consider migrating assets to new, secure wallets and report the incident to relevant security teams or platforms for further investigation.