paal[.]sushi-cn[.]biz

Analysis on paal.sushi-cn.biz shows a domain created on 31 October 2025 and registered through Dynadot LLC. The authoritative name servers apollo.ns.cloudflare.com and meera.ns.cloudflare.com resolve the domain to IP address 142.250.181.228, which belongs to AS15169 Google LLC and is geolocated in the United States. No TLS certificate is presented, indicating the site operates without HTTPS protection. The page title returned from the HTTP response is the generic string "Google," providing no indication of malicious content beyond the title itself.

Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, the lowest possible rating. VirusTotal records eight of ninety‑five scanning engines flagging the domain, corroborating the low trust assessment. The domain is currently listed on a single security blocklist and has been actively blocked by the PhishDestroy service. The threat classification is a brand impersonation targeting SushiSwap, with the underlying scam type identified as a crypto scam.

Defenders should note that the domain is already offline, reducing immediate exposure, but the infrastructure—Google‑owned IP space and Cloudflare name servers—may be reused for future malicious campaigns. Continuous monitoring of the associated IP range, the Cloudflare name servers, and any new domains registered by the same registrar is recommended. Blocking the domain at the DNS level and adding the IP address to outbound filtering rules can prevent inadvertent connections should the site reactivate. Additionally, security teams should update URL and domain reputation feeds to include paal.sushi-cn.biz, ensuring that endpoint protection and web gateways flag any future resolutions to this host.