sushiiswap[.]icu

The domain sushiiswap.icu is identified as a brand impersonation threat targeting SushiSwap, a decentralized finance (DeFi) exchange platform. Analysis indicates this domain was actively used to mimic legitimate SushiSwap services, likely to deceive users into interacting with fraudulent smart contracts or disclosing sensitive credentials. The domain is currently offline, though prior activity suggests it may have been part of a broader campaign to exploit users in the cryptocurrency ecosystem. Infrastructure analysis reveals the domain was registered on October 16, 2025, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. It resolved to the IP address 104.21.42.132, hosted on AS13335 (Cloudflare, Inc.), a common proxy service used to obscure malicious infrastructure. The domain appears on one security blocklist and has been flagged by 14 of 95 security vendors on VirusTotal, indicating a consensus on its malicious nature. Notably, the page title, 'Uniswap | Trade Crypto on DeFi’s Leading Exchange Wallet,' further confirms the intent to impersonate not only SushiSwap but also Uniswap, another prominent DeFi platform. The absence of an SSL certificate is another red flag, as legitimate financial services typically enforce HTTPS encryption. The domain has since been taken offline, likely due to enforcement actions such as those by PhishDestroy, which blocked access. However, given the transient nature of such threats, users and organizations are advised to remain vigilant. It is recommended to monitor for similar domains registered under the same registrar or resolving to the same IP range. Network defenders should update blocklists to include this domain and its associated indicators, such as the IP address and registrar details. Users should verify the authenticity of DeFi platforms by cross-referencing official sources and avoiding interaction with domains that exhibit impersonation tactics or lack proper security certificates.