began--sushiswap--account[.]pages[.]dev

This domain, began--sushiswap--account.pages.dev, is actively impersonating the Arbitrum ecosystem under the guise of a Sushiswap-related service, as indicated by its page title 'Sushiswap® Exchange | Complete Guide, Login Help' and explicit branding in the threat intelligence data. Registered on October 27, 2025, through Cloudflare, Inc., the domain resolves to IP address 188.114.97.3, associated with AS13335 (Cloudflare, Inc.) in the United States. Infrastructure analysis reveals the use of Cloudflare technologies, including HSTS and HTTP/3, alongside a Cloudflare-issued SSL certificate (WE1) and nameservers aisha.ns.cloudflare.com and justin.ns.cloudflare.com. The domain is currently flagged by 7 of 94 security vendors on VirusTotal and appears on at least one security blocklist, specifically PhishDestroy. Its Gridinsoft trust score is 0/100, further supporting its classification as a high-risk crypto scam. The domain remains active as of July 12, 2026, with an HTTP 200 status, indicating operational infrastructure. Defenders should treat this domain as a confirmed brand impersonation threat targeting users of Arbitrum-based services, likely aiming to harvest credentials or facilitate fraudulent transactions. No evidence of a specific phishing kit or additional malicious payloads is currently available, but the combination of brand impersonation, low trust scores, and blocklist presence justifies immediate blocking and monitoring for related infrastructure.