wkeydao[.]sushi[.]baby

The domain wkeydao.sushi.baby is a confirmed phishing site engaged in brand impersonation targeting SushiSwap, a cryptocurrency exchange. It was designed to deceive users into believing they were interacting with the legitimate SushiSwap platform, posing an elevated risk of cryptocurrency scams. As of the latest verification, wkeydao.sushi.baby has been taken offline, though it previously operated without a known drainer kit.

Technical indicators confirm the malicious nature of wkeydao.sushi.baby. The domain was flagged by 2 of 95 security vendors on VirusTotal, including Fortinet and SOCRadar, and appeared on 1 security blocklist (PhishDestroy). Registered through Dynadot LLC on August 14, 2025, it resolved to the IP address 172.67.188.138, hosted on Cloudflare's network (AS13335) in the US. No SSL certificate was present, and the observed page title was 'Just a moment...'. Nameservers were brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, and Gridinsoft assigned a trust score of 0/100.

Users who interacted with wkeydao.sushi.baby should immediately revoke any token approvals granted to unknown contracts and transfer funds to a new wallet to prevent unauthorized access. If credentials were entered, change passwords on the legitimate SushiSwap platform and enable two-factor authentication. Report the domain to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to aid in broader takedown efforts. Victims should also monitor accounts for unauthorized transactions and consider reporting the incident to local cybercrime authorities.