tradesushi[.]co

This domain, tradesushi.co, is currently flagged as an active brand impersonation threat targeting SushiSwap, a decentralized cryptocurrency exchange platform. Analysis indicates the domain is designed to deceive users into believing they are interacting with legitimate SushiSwap services, potentially leading to credential theft, unauthorized transactions, or financial loss. The threat type is classified as high-risk due to its targeted nature and ongoing operational status. Infrastructure analysis reveals the domain was registered on June 3, 2026, through Dynadot Inc, a registrar commonly associated with malicious domains. It resolves to the IP address 104.21.60.15, which has been linked to other phishing campaigns. As of the latest assessment, tradesushi.co is detected by 5 of 95 security vendors on VirusTotal, with appearances on 3 distinct security blocklists. The domain employs a Let's Encrypt SSL certificate (identifier E7), a tactic frequently observed in phishing sites to mimic legitimacy. Additional indicators include active blocking by multiple threat intelligence feeds, confirming its malicious intent. Current status confirms tradesushi.co remains operational and unmitigated. Users and organizations are advised to implement immediate countermeasures, including domain blacklisting, network-level blocking of the associated IP (104.21.60.15), and deployment of endpoint protection rules to detect and prevent access. Cryptocurrency platforms and wallet providers should issue alerts to users regarding this impersonation attempt. Continuous monitoring of related infrastructure is recommended, as threat actors often pivot to new domains or IPs following detection.