sushi-cn[.]asia

This domain, sushi-cn.asia, is flagged as a brand-impersonation threat targeting SushiSwap, a decentralized cryptocurrency exchange platform. Analysis indicates the site employs deceptive tactics, including a misleading page title labeled 'Google,' likely intended to trick users into believing they are interacting with a legitimate service. No direct evidence of a drainer kit is present, but the domain's infrastructure and impersonation techniques align with credential harvesting and wallet-drain operations commonly associated with cryptocurrency phishing schemes. Technical indicators reveal the domain was registered through Dynadot LLC on October 31, 2025, a date inconsistent with standard registration timelines, suggesting potential backdating or misconfiguration. It resolves to the IP address 142.251.163.104, which is associated with legitimate infrastructure but has been repurposed for malicious activity. VirusTotal detection shows 3 out of 95 security vendors flagging the domain, while it appears on four independent security blocklists, including Codeesura, Polkadot, PhishDestroy, and Enkrypt. The domain has not been listed on Google Safe Browsing at the time of analysis, and its Gridinsoft trust score is 0 out of 100, reinforcing its malicious classification. As of the latest assessment, sushi-cn.asia has been taken offline, reducing immediate exposure to end users. However, the domain remains registered and could be reactivated or repurposed for future campaigns. Organizations and individuals are advised to block the domain at the DNS or firewall level, monitor for related subdomains or typosquatting variants, and educate users on recognizing brand-impersonation tactics. Given the elevated risk level, continued vigilance is recommended, particularly for entities operating in the decentralized finance space.