api3[.]sushi-com[.]bond

Analysis of api3.sushi-com.bond shows a recently registered domain (creation 21 Oct 2025) that targets the SushiSwap brand through a crypto‑scam impersonation. The domain is registered via Dynadot LLC and resolves to IP 142.250.181.228, which belongs to AS15169 Google LLC located in the United States. The hosting provider is identified as Google, and the domain uses Cloudflare authoritative nameservers apollo.ns.cloudflare.com and meera.ns.cloudflare.com. No TLS certificate is presented; the site is reachable only over HTTP, which further reduces trust.

Gridinsoft assigns a trust score of 0 / 100, indicating a high‑risk profile. VirusTotal reports that three of ninety‑five scanned security vendors flag the domain as malicious, and the domain appears on a single public security blocklist. PhishDestroy has also listed the domain as blocked. The page title returned by the HTTP response is “Google”, and no additional content has been captured, leaving the exact phishing page layout unknown.

The threat is classified as a crypto scam, leveraging the SushiSwap brand to lure victims. Defenders should immediately block the domain and its resolved IP address at network perimeter devices, add the domain to internal URL filtering lists, and monitor for any future resolution changes. Given the lack of TLS and the low trust score, any attempt to retrieve resources from this host should be denied. Continuous observation of the associated Cloudflare nameservers is recommended to detect potential re‑registration or migration to new IP ranges.