prompt-sushi[.]store

Analysis indicates that prompt-sushi.store was registered on February 21, 2026 and resolves to the IP address 104.21.80.1, which is owned by Cloudflare, Inc. (AS13335) and geolocated in the United States. The site is currently taken offline, but historical observations show a page title of “Nur einen Moment…”, which is consistent with a generic waiting page often used in credential‑harvesting flows. The domain is explicitly associated with brand impersonation of SushiSwap and is classified as a crypto‑related scam. Security telemetry shows that the domain appears on four independent blocklists and has been blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura.

On VirusTotal, one of ninety‑five scanning vendors flagged the domain, providing an early indicator of malicious intent. Reputation services assign a low trust score: Scamadviser rates the site at 45 / 100, while Gridinsoft reports a score of 0 / 100, reflecting strong confidence in its malicious nature. The SSL certificate is identified only as “WE1”, offering no additional validation of legitimacy.

Given the elevated risk rating, defenders should update perimeter defenses to block traffic to the domain and its underlying Cloudflare IP, enforce domain‑level filtering for any references to SushiSwap, and monitor for any future re‑registration or similar host‑header patterns. Continuous observation of related indicator sets, including blocklist memberships and any new VirusTotal detections, is recommended to maintain situational awareness. The current offline status limits direct content analysis, so the exact phishing payload and user‑interaction flow remain unknown pending potential re‑hosting.