sushi-sign[.]top

The domain sushi-sign.top was registered on 2026-02-21 and is currently taken offline. DNS resolution points to the IPv4 address 107.172.83.150, which belongs to AS36352 operated by HostPapa in the United States. An SSL certificate identified as R11 is present, indicating that TLS is offered but does not imply trust. The site’s HTML title reads “Stake SUSHI | Sushi”, a clear reference to the SushiSwap brand.

Threat intelligence classifies the domain as a crypto‑scam that impersonates SushiSwap, leveraging the familiar “Stake SUSHI” phrasing to lure users into staking or depositing assets. The domain appears on two independent phishing blocklists, PhishDestroy and ScamSniffer, confirming that at least two external monitoring services have flagged it as malicious. VirusTotal analysis shows that seven of ninety‑three scanning engines returned a positive detection, reinforcing the malicious assessment.

While the exact malicious payload or credential‑harvesting mechanism has not been publicly disclosed, the convergence of brand impersonation, a crypto‑focused title, and multiple vendor detections suggests a high likelihood of credential or private‑key theft. Defenders should add sushi‑sign.top to URL filtering and DNS sinkhole rules, monitor outbound connections to 107.172.83.150, and enforce multi‑factor authentication for any accounts linked to SushiSwap. Organizations should also educate users about unsolicited staking offers that reference SushiSwap, and consider reporting the domain to additional threat‑exchange platforms to broaden community awareness.