prime-sushi[.]top

This domain is flagged as an elevated-risk brand impersonation threat targeting SushiSwap, a decentralized finance protocol. Analysis indicates the site operates as a DeFi phishing platform, presenting fraudulent staking interfaces to deceive users into connecting wallets and authorizing malicious smart contracts. The page title, 'Stake SUSHI | Sushi,' directly mimics legitimate SushiSwap staking portals, increasing the likelihood of user compromise through social engineering and technical spoofing. Infrastructure analysis reveals multiple concrete threat indicators. The domain prime-sushi.top was registered on February 26, 2025, through NameSilo, LLC, a registrar frequently associated with high-risk registrations. It resolves to the IP address 107.172.83.150, a host previously linked to cryptocurrency scams and phishing campaigns. The domain appears on one security blocklist, specifically PhishDestroy, and is flagged by 2 out of 95 security vendors on VirusTotal, indicating limited but confirmed detection. The site has since been taken offline, though historical snapshots confirm its use in active phishing operations. Mitigation requires immediate action from both users and security teams. Users who interacted with prime-sushi.top should revoke all smart contract approvals associated with the domain using a blockchain explorer or wallet security tool. Security teams should monitor for wallet addresses or contract interactions linked to 107.172.83.150 and the domain’s registration cohort. Network-level blocking of the IP and domain is recommended to prevent lateral movement or secondary infections. Given the targeted nature of DeFi phishing, organizations should prioritize user education on verifying staking URLs and employing hardware wallets or isolated environments for high-value transactions.