sushi-trade[.]co

This domain is flagged as an active brand impersonation threat targeting SushiSwap, a decentralized finance platform. Analysis indicates a high-risk classification due to its deceptive infrastructure and confirmed malicious activity aimed at harvesting user credentials and cryptocurrency wallet access. The domain employs tactics designed to mislead users into believing they are interacting with the legitimate SushiSwap interface, posing significant financial and data security risks. Infrastructure analysis reveals the domain sushi-trade.co was registered through DYNADOT LLC on June 03, 2024, and currently resolves to the IP address 104.21.20.83. Detection metrics show 5 out of 95 security vendors on VirusTotal have flagged the domain as malicious, while it appears on three distinct security blocklists. The site presents a page title of 'Google,' likely an attempt to evade detection or mislead automated security tools. The SSL certificate is issued by Let's Encrypt, a common tactic among phishing domains to appear legitimate. Additional indicators include its presence on multiple blocklists and active blocking by decentralized security protocols. Mitigation against this threat requires immediate action from both users and security teams. Users should verify domain authenticity before interacting with any platform requesting credentials or wallet access, particularly those resembling SushiSwap. Security teams are advised to implement domain-based blocking for sushi-trade.co and monitor for related infrastructure, such as the resolving IP 104.21.20.83. Network-level protections should be updated to include this domain in denylists, and endpoint detection rules should be configured to alert on any attempts to access it. Given the domain's recent registration and active status, continuous monitoring for similar impersonation attempts is recommended.