sushiswap--portal-us[.]pages[.]dev

This domain, sushiswap--portal-us.pages.dev, is actively impersonating SushiSwap, a decentralized exchange platform, as indicated by the page title 'Sushiswap ® Exchange — Login, Account Help & Troubleshooting Guide' and the brand target field. Registered on October 25, 2025, through Cloudflare, the domain resolves to IP 172.66.44.197 (AS13335, US) and is served via Cloudflare nameservers (adelaide.ns.cloudflare.com, harvey.ns.cloudflare.com). The site employs HSTS and HTTP/3, with a valid SSL certificate (WE1). As of July 12, 2026, the domain remains active, returning an HTTP 200 status, and appears on one security blocklist. Analysis of 94 security vendors on VirusTotal reveals 7 detections, suggesting recognition of malicious intent by a subset of engines. The Gridinsoft trust score of 0/100 further supports the assessment of high risk. Defenders should note that the domain is hosted on Cloudflare infrastructure, which may complicate takedown efforts or geolocation-based blocking. The exact phishing mechanics (e.g., credential harvesting, wallet drainer) are not confirmed, as the page content has not been analyzed. Immediate action is recommended, including blocking the domain and IP at perimeter defenses, monitoring for internal connections to 172.66.44.197, and alerting users to the impersonation of SushiSwap. No evidence suggests this domain is part of a broader campaign, but defenders should cross-reference the IP and nameserver infrastructure for related threats.