sushi-com[.]lat

The domain sushi-com.lat is a confirmed phishing site engaged in brand impersonation targeting SushiSwap, a cryptocurrency exchange platform. It was designed to deceive users into believing they were interacting with the legitimate SushiSwap service, likely to harvest credentials or facilitate fraudulent transactions. No drainer kit was identified, but the site posed an elevated risk due to its cryptocurrency scam focus. As of the latest verification, sushi-com.lat has been taken offline.

Technical analysis reveals that sushi-com.lat was flagged by 3 of 95 security vendors on VirusTotal, including CRDF, Gridinsoft, and SOCRadar, with a Gridinsoft trust score of 0/100. The domain was registered through Dynadot LLC on September 22, 2025, and resolved to the IP address 142.250.185.228, hosted by Google LLC in the US. It appeared on one security blocklist, PhishDestroy, and used an SSL certificate issued by Google Trust Services / WE1. The observed page title was 'Google', and the site employed technologies such as Google Web Server, HSTS, and HTTP/3. Nameservers were apollo.ns.cloudflare.com and meera.ns.cloudflare.com.

Users who may have interacted with sushi-com.lat should immediately change any credentials entered on the site, enable two-factor authentication (2FA) on their accounts, and monitor for unauthorized transactions or account activity. Cryptocurrency users should revoke any token approvals granted to suspicious contracts and consider transferring funds to a new wallet. The domain can be reported to Google Safe Browsing, PhishTank, or the impersonated brand, SushiSwap, to aid in further takedown efforts.