en-auth-sushiswap[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation threat specifically targeting SushiSwap, a decentralized cryptocurrency exchange. Analysis indicates the infrastructure is designed to deceive users into believing they are interacting with the legitimate SushiSwap platform, potentially facilitating unauthorized access to wallets or sensitive financial data. The threat type aligns with known patterns of crypto-related fraud, where attackers exploit brand trust to execute scams or deploy malicious payloads. Infrastructure analysis reveals the domain en-auth-sushiswap.pages.dev was registered on October 15, 2025, through Cloudflare, Inc. It resolves to the IPv6 address 2606:4700:310c::ac42:2f6d, hosted on Cloudflare’s network (AS13335) in the United States. The domain appears on one security blocklist, specifically PhishDestroy, and is flagged by 8 out of 95 security vendors on VirusTotal. The SSL certificate is issued by Google Trust Services (WE1), a common feature in both legitimate and fraudulent domains. The page title, 'SushiSwap – Secure, Fast, and Decentralized Crypto Exchange,' closely mimics the official branding, further corroborating the impersonation attempt. Mitigation steps for this threat type include immediate blocking of the domain and its associated IP address at the network perimeter. Organizations should update security policies to flag domains registered through Cloudflare’s registrar service that impersonate known cryptocurrency platforms. End users should be educated to verify domain authenticity by cross-referencing official communications from SushiSwap, particularly when prompted for wallet connections or sensitive information. Monitoring for similar domains with recent creation dates and low trust scores can help preemptively identify additional impersonation attempts. Given the active status of this domain, continuous vigilance and real-time threat intelligence integration are recommended to prevent potential financial losses.