la-sushi[.]cfd

The domain la-sushi.cfd was created on February 21, 2026 and is presently resolved to the IPv6 address 2606:4700:3030::6815:1998. That address belongs to Cloudflare, Inc. (AS13335) and is geolocated to the United States. An HTTPS connection presents a certificate labeled WE1, and the only observable HTTP response is a page whose title reads "Just a moment...", which is typical of a Cloudflare interstitial page. The domain is listed on four public security blocklists and is explicitly blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura.

VirusTotal analysis indicates that two of ninety‑three scanning vendors have flagged the domain, providing independent confirmation of malicious intent. Intelligence categorizes the site as a crypto scam that impersonates the SushiSwap brand, suggesting an attempt to deceive users into providing cryptocurrency credentials or executing unauthorized transactions. At the time of reporting the site has been taken offline, limiting direct observation of payloads, credential‑harvesting forms, or redirection behavior. Consequently, the precise mechanisms employed by the actor remain unknown.

Defenders are advised to continue denying network traffic to la‑sushi.cfd, propagate the domain to internal DNS and URL filtering lists, and monitor the associated Cloudflare IP range for any re‑use of the same infrastructure. Adding the domain to threat‑intel feeds and alerting SOC personnel to the brand‑impersonation pattern will help mitigate potential repeat attempts. The combination of brand impersonation, partial vendor detections, and blocklist presence supports the elevated risk rating assigned to this infrastructure.