soon-sushi[.]cfd

soon-sushi.cfd is flagged as a brand‑impersonation site targeting SushiSwap. The domain was registered through Namecheap on 18 August 2025 and currently resolves to 104.21.48.1, an address owned by Cloudflare (AS13335) with a US location. The TLS certificate presented is identified as “WE1”, and the Gridinsoft trust score is 0 / 100, indicating a lack of trust. Automated scans on VirusTotal show that 3 of 93 security vendors have marked the domain as malicious.

Four independent blocklists – PhishDestroy, Polkadot, Enkrypt and Codeesura – have already listed the domain, and it appears on a total of four security blocklists. The HTTP response currently returns a page titled “Nur einen Moment…”, but no further content analysis is available because the site has been taken offline. The risk rating is elevated, reflecting the combination of recent creation, low trust score, and active blocklist listings.

Defenders should add the domain to URL filtering and DNS sinkhole policies, block the associated IP address where feasible, and monitor for any re‑registration or use of similar look‑alike domains. Because the IP is shared across many legitimate Cloudflare customers, blanket IP blocking may cause collateral impact; therefore, domain‑level controls are preferred. Continuous threat‑intel feeds should be consulted for any resurgence of the domain or related infrastructure, and incident response teams should be prepared to investigate any inbound traffic that matches the observed TLS fingerprint or page title.