ltc-sushi[.]lat

ltc-sushi.lat was registered on 21 February 2026. The domain is currently offline, having been taken down after detection. Infrastructure analysis shows that the domain resolves to IP address 104.21.96.1, which belongs to Cloudflare, Inc. (ASN 13335) and is geolocated to the United States. The SSL certificate presented for the site is recorded as WE1, indicating a possibly self‑signed or low‑trust certificate. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on four independent security blocklists, specifically PhishDestroy, Polkadot, Enkrypt, and Codeesura.

VirusTotal scans report that one of ninety‑three security vendors flagged the domain, confirming at least one detection. The page title returned from the live site was “Nur einen Moment…”, which does not reveal any brand‑specific content but aligns with typical placeholder text. The domain is classified as a crypto‑related scam and is explicitly noted to impersonate the SushiSwap brand. No additional evidence such as Safe Browsing status, OTX tags, or registrar details were provided.

The lack of a live HTTP response limits deeper content analysis, and the exact phishing kit or payload remains unknown. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑registration attempts, and add the associated IP address to deny lists. Because the domain leveraged Cloudflare’s infrastructure, any future re‑hosting on the same service may inherit similar reputation, so security teams should consider broader Cloudflare IP monitoring. Continuous threat‑intel feeds should be consulted for updates on the four blocklists that already listed the domain, and any new detections should be correlated with the SushiSwap brand to assess potential campaign expansion.