dexe-sushi[.]cfd

On July 22, 2026, the domain dexe-sushi.cfd was observed as part of a brand‑impersonation campaign targeting SushiSwap. The domain was registered on August 18, 2025 via Namecheap and resolves to the IPv6 address 2606:4700:3031::6815:2aa5, which is announced by AS13335, the Cloudflare network, and geolocated to the United States. An SSL certificate identified as “WE1” was present at the time of analysis, and the HTTP response contained the page title “Nur einen Moment…”. The site has been taken offline, but historical records show it was flagged by two of ninety‑three VirusTotal scanners, and it appears on four independent blocklists (PhishDestroy, Polkadot, Enkrypt, Codeesura).

The Gridinsoft trust score for the domain is 0 out of 100, indicating a high confidence of malicious intent. The campaign is classified as a crypto scam, leveraging the SushiSwap brand to lure victims, although the exact payload or credential‑harvesting mechanism has not been publicly disclosed. Defenders should continue to block the domain at DNS and proxy layers, monitor for any resurgence of the same host‑header or certificate, and add the IPv6 address to reputation‑based firewalls.

Because the infrastructure is hosted on Cloudflare, attribution to a specific threat actor remains uncertain, and the low detection count suggests limited exposure at the time of capture. Ongoing surveillance of the registrar Namecheap for similar registrations and periodic re‑query of security‑vendor feeds are recommended to capture any re‑use of the naming pattern or certificate. Until the domain is definitively removed from blocklists, security teams should treat any traffic to dexe-sushi.cfd as malicious.