sushiswap[.]brendalima77002[.]workers[.]dev

Analysis indicates that the domain sushiswap.brendalima77002.workers.dev is actively impersonating SushiSwap, a decentralized finance platform. Registered through Cloudflare, Inc. on March 18, 2025, the domain resolves to the IP address 172.67.170.170, which is associated with AS13335 (Cloudflare, Inc.) and geolocated in the United States. The domain currently returns an HTTP 200 status, suggesting it is operational, and presents the page title 'YieldFi | Capital Market for the Internet Economy,' which does not align with the expected branding of SushiSwap. Infrastructure analysis reveals the use of Cloudflare, Google Cloud, and Node.js technologies, alongside React and Next.js frameworks. The domain lacks conventional nameservers, a characteristic often observed in ephemeral or abuse-prone hosting setups. Security vendor detection is limited but notable: six of ninety-four engines on a widely used scanning platform flagged the domain as malicious. Additionally, the domain appears on one security blocklist, specifically PhishDestroy, and has been assigned a trust score of 0/100 by Gridinsoft. The SSL certificate is issued under the WE1 authority, a detail that does not inherently indicate compromise but may warrant further scrutiny in the context of brand impersonation. Defenders are advised to treat this domain as high-risk, particularly in environments where SushiSwap or decentralized finance platforms are accessed. Monitoring for connections to 172.67.170.170 and the domain itself is recommended, alongside blocking or alerting mechanisms for users attempting to access it. The exact content and functionality of the site remain unanalyzed, and further investigation is required to determine the full scope of the threat.