phala[.]sushiswap[.]art

PhishDestroy has identified phala.sushiswap.art as a brand impersonation threat specifically targeting users of the SushiSwap decentralized exchange. This domain was created on September 16, 2025, and registered through Dynadot LLC, a common registrar for phishing operations. The page title was observed as 'Just a moment...', a typical Cloudflare challenge page used to mask malicious activity or collect visitor data before redirecting to a phishing interface.

Technical indicators show that phala.sushiswap.art resolves to IP address 188.114.97.3 and currently lacks an SSL certificate, increasing the risk of data interception. VirusTotal analysis reports 0 out of 95 security vendors flagging the domain, indicating it has not yet been widely detected by antivirus engines. However, it appears on one security blocklist and has been flagged by Google Safe Browsing as a potential threat. The domain's creation date so close to its discovery suggests a short-lived campaign designed to evade detection.

The domain is currently offline, indicating that hosting providers or law enforcement may have taken action. Despite this, residual risk remains as the domain could be reactivated or similar domains may appear. Users should avoid any unsolicited links claiming to be from SushiSwap, verify URLs carefully, and report any suspicious domains to security teams. PhishDestroy continues to monitor for related threats and recommends enabling two-factor authentication on all DeFi accounts.