eth-sushi[.]click

Analysis indicates that eth-sushi.click was registered on June 08, 2026 through Dynadot, LLC. The domain resolves to the IPv4 address 130.12.180.128, which is currently associated with active hosting. Reputation services have flagged the domain as malicious: three independent blocklists (PhishDestroy, MetaMask, SEAL) have listed it, and VirusTotal returns 7 positive detections out of 91 scanners. The presence on multiple blocklists and the detection count suggests a high confidence that the site is being used for phishing. The threat is classified as generic phishing, and the risk level is elevated.

The domain is still active as of the report date, July 29, 2026. Evidence is limited to registration, hosting, and detection metadata; no public page content, SSL certificate details, or HTTP response codes have been disclosed. Consequently, the exact phishing payload, targeted brand, or credential‑harvesting technique remains unknown. Defenders should block traffic to 130.12.180.128 and add eth-sushi.click to local deny lists.

Monitoring of DNS queries for this domain and its IP should be intensified, and any observed credential submissions should be treated as compromised. Organizations employing email filters or web gateways should ensure that the three blocklists (PhishDestroy, MetaMask, SEAL) are enforced. Continuous re‑scanning on VirusTotal or similar platforms is recommended to capture any changes in detection signatures.