ssv-sushi[.]cfd

This domain, ssv-sushi.cfd, poses a direct threat to cryptocurrency users by impersonating SushiSwap, a decentralized exchange platform. Analysis indicates the site functions as a crypto drainer, designed to trick visitors into connecting their wallets. Once connected, the site can execute unauthorized transactions, draining funds without the user's consent. The page title 'Nur einen Moment…' suggests a fake loading screen to deceive users into waiting while malicious scripts execute in the background. Given the domain's recent creation and active blocking by security providers, this infrastructure is part of an ongoing phishing campaign targeting DeFi users. Infrastructure analysis reveals multiple technical indicators confirming the malicious nature of ssv-sushi.cfd. The domain was registered on September 5, 2025, through NameSilo, LLC, a registrar frequently used for short-lived phishing domains. VirusTotal reports that 2 out of 95 security vendors flag this domain as malicious, while Gridinsoft assigns it a trust score of 0/100. The domain resolves to the IP address 104.21.64.1, which is associated with other recently reported phishing sites. Additionally, the domain appears on four security blocklists, including Polkadot, Codeesura, PhishDestroy, and Enkrypt, further confirming its role in fraudulent activity. The combination of these factors indicates a deliberate attempt to impersonate SushiSwap and exploit users. Users who visited ssv-sushi.cfd should take immediate action to secure their assets. First, disconnect any wallets that were connected to the site, as this prevents further unauthorized transactions. Next, revoke any suspicious token approvals or smart contract interactions using a trusted blockchain explorer or wallet management tool. Monitor all wallet activity for unfamiliar transactions and report any unauthorized transfers to the relevant platform. If funds were lost, document all details, including transaction hashes and timestamps, for potential recovery efforts. Finally, update security settings, such as enabling transaction simulation tools or hardware wallet protections, to prevent future incidents. Given the domain's elevated risk level and offline status, users should remain vigilant for similar phishing attempts targeting DeFi platforms.