sushiswap[.]to

The domain sushiswap.to was registered on October 24, 2025 through a registrar listed as the Government of Kingdom of Tonga. It resolves to the Cloudflare address 172.67.214.104, which is associated with AS13335 in the United States. DNS resolution is served by the Cloudflare name servers sonia.ns.cloudflare.com and stan.ns.cloudflare.com. The site presents a page title of "Sushi Swap | DEX" and is identified as impersonating the legitimate SushiSwap brand, fitting the reported crypto‑scam classification. TLS is provided by a Let’s Encrypt certificate (E8), indicating the use of a free, automated certificate authority. Infrastructure analysis shows the web stack includes PHP, Nginx, OpenResty, Google Hosted Libraries, and the Google Font API, all typical of publicly available web‑hosting components.

Threat intelligence signals are significant. The domain appears on one security blocklist and has been blocked by PhishDestroy. The Gridinsoft trust score is 0 out of 100, reflecting an extremely low confidence rating. AlienVault OTX references the domain in fifteen distinct threat‑intelligence pulses, reinforcing its association with malicious activity. VirusTotal reports that eighteen of ninety‑five scanning engines have flagged the domain, providing additional corroboration of its malicious nature.

Current operational status is offline, which limits immediate observation of payload delivery or user interaction. Nonetheless, the combination of brand impersonation, low trust score, blocklist presence, multiple vendor detections, and the Cloudflare‑based hosting pattern aligns with known crypto‑draining campaigns. Defenders should continue to block the domain at network perimeter devices, update URL filtering lists, and monitor for any resurgence of the domain or associated IP addresses.