in-sushi[.]top

The domain in-sushi.top has been identified as a brand impersonation phishing infrastructure targeting SushiSwap, a decentralized finance protocol. Analysis confirms the domain was actively used to deceive users by mimicking the legitimate SushiSwap platform. As of the latest assessment, the domain has been taken offline, though prior activity suggests it was operational for a limited period. Infrastructure analysis reveals the domain was registered through NameCheap, Inc. on August 30, 2025, and resolved to the IPv6 address 2606:4700:3030::ac43:c3bc. Security vendor detections on VirusTotal indicate that 2 out of 95 engines flagged the domain as malicious. The domain appears on four security blocklists, and its trust score, as evaluated by Gridinsoft, is 0 out of 100. The page title associated with the domain was 'Pieni hetki...', which may have been used to simulate a loading or transitional state to evade suspicion. Additional blocking has been implemented by Polkadot, Codeesura, PhishDestroy, and Enkrypt, further corroborating its malicious intent. The current offline status of in-sushi.top reduces immediate risk, though historical activity warrants continued monitoring. Organizations and users are advised to verify the authenticity of decentralized finance platforms by cross-referencing official domains and confirming SSL certificates. Network-level blocking of the domain and its associated IP address is recommended for proactive defense. Security teams should review logs for connections to 2606:4700:3030::ac43:c3bc and the domain itself to identify potential prior exposure. Given the elevated risk of brand impersonation in the decentralized finance sector, heightened vigilance and user education remain critical.