wkeydao-sushi[.]xyz

This domain, wkeydao-sushi.xyz, has been flagged as a high-concern brand impersonation threat with an elevated risk level. Specifically, it represents a sophisticated crypto drainer designed to mimic the SushiSwap decentralized exchange, aiming to trick users into connecting their wallets and ultimately stealing their digital assets. The threat was identified through active monitoring and has since been taken offline, but the infrastructure behind it remains a concern for future campaigns.

Technical analysis reveals a domain that resolves to IP address 188.114.97.3, which is associated with Cloudflare's reverse proxy network, a common tactic used by threat actors to obscure their true origin. The domain was created on February 21, 2026, and its page title, "Nur einen Moment…," suggests a German-language lure, potentially targeting European users. VirusTotal data shows that 7 out of 95 security vendors flagged this domain as malicious, and it appears on 5 separate security blocklists. The SSL certificate (WE1) was issued to the domain, further legitimizing its appearance. These indicators collectively paint a clear picture of a well-prepared phishing infrastructure.

Given the specific nature of this crypto drainer threat, users are strongly advised to never connect their wallets to any website that appears to be a replica of SushiSwap or any other decentralized exchange, especially if the URL contains suspicious elements like "wkeydao-sushi.xyz." Always verify the official domain through trusted sources, such as the project's official website or social media channels. Enable browser-based anti-phishing protections and use hardware wallets for transaction signing. If you have already interacted with this domain, immediately revoke token approvals and transfer your assets to a new wallet. Staying vigilant against brand impersonation scams is crucial in the cryptocurrency space.