lay-sushi[.]cfd

The domain lay-sushi.cfd is a confirmed phishing site engaged in brand impersonation targeting SushiSwap, a cryptocurrency exchange. It posed an elevated risk as a cryptocurrency scam, designed to deceive users into interacting with fraudulent pages under the guise of the legitimate SushiSwap platform. As of the latest verification, lay-sushi.cfd has been taken offline, though it previously operated without an associated drainer kit.

Technical analysis of lay-sushi.cfd reveals limited but notable detection. The domain was flagged by 2 of 95 security vendors on VirusTotal, including Gridinsoft and Trustwave. It appeared on 4 security blocklists, specifically PhishDestroy, Polkadot, Enkrypt, and Codeesura. Registered through NameSilo, LLC on 2025-09-05 07:22:14, the domain resolved to the IP address 172.67.197.206, hosted on Cloudflare’s infrastructure (AS13335) in the US. No SSL certificate was issued, and the observed page title was 'Nur einen Moment…'. Nameservers were celeste.ns.cloudflare.com and kareem.ns.cloudflare.com. Google Safe Browsing did not flag the domain at the time of assessment.

Users who interacted with lay-sushi.cfd should immediately revoke any token approvals granted to unknown or suspicious contracts using tools like Etherscan’s token approval checker or Revoke.cash. Transfer remaining funds to a new, secure wallet to mitigate potential unauthorized access. Enable two-factor authentication (2FA) on all cryptocurrency and financial accounts, and monitor for unauthorized transactions. Report the phishing domain to platforms such as Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group (APWG) to assist in broader takedown efforts.