white[.]sushi-com[.]bond

Analysis of white.sushi-com.bond indicates a brand impersonation campaign targeting SushiSwap, a decentralized cryptocurrency exchange. The domain was registered on October 21, 2025, through Dynadot LLC and resolved to IP 142.250.176.196, hosted on Google LLC infrastructure (AS15169). No SSL certificate was detected, increasing the risk of unencrypted data interception. The page title 'Google' suggests an attempt to mimic a legitimate service or evade detection, though the exact content and functionality of the site remain unconfirmed due to its offline status as of July 25, 2026. Infrastructure analysis reveals Cloudflare nameservers (apollo.ns.cloudflare.com, meera.ns.cloudflare.com), a common tactic to obscure hosting details and improve resilience.

The domain appears on one security blocklist (PhishDestroy) and was flagged by 4 of 95 security vendors on VirusTotal, indicating moderate detection but not universal consensus. Gridinsoft assigned a trust score of 0/100, further supporting its classification as malicious. Defenders should treat this domain as part of a crypto scam operation, likely designed to harvest credentials, private keys, or facilitate fraudulent token transfers. The absence of SSL and use of Cloudflare nameservers are red flags for phishing infrastructure.

While the domain is currently offline, monitoring for re-activation is recommended. If encountered in logs or proxy data, block the domain and IP 142.250.176.196. Correlate with other SushiSwap-themed domains registered through Dynadot or hosted on Google AS15169 for broader threat hunting. No evidence of a phishing kit or additional payloads has been confirmed at this time.