prompt[.]sushis[.]ninja

This domain, prompt.sushis.ninja, is identified as a brand_impersonation threat specifically targeting SushiSwap, a decentralized cryptocurrency exchange. Analysis indicates the presence of a crypto drainer kit, designed to siphon digital assets from unsuspecting users by mimicking the legitimate SushiSwap staking interface. The page title, 'Stake PROMPT | Sushi 🍣,' reinforces the deception by leveraging SushiSwap’s branding and terminology to appear authentic. Infrastructure analysis reveals the domain resolves to the IP address 104.21.32.1, a Cloudflare proxy commonly used to obfuscate malicious infrastructure. The domain is registered through an undisclosed registrar, and its creation date remains unconfirmed in public records. VirusTotal detection metrics show 1 out of 95 security vendors flagged the domain as malicious, while Gridinsoft assigned a trust score of 0/100. The domain appears on a single security blocklist and was actively blocked by PhishDestroy. Google Safe Browsing (GSB) status is not explicitly listed, but the low detection count suggests limited visibility prior to takedown. As of the latest assessment, prompt.sushis.ninja has been taken offline, likely due to enforcement actions by hosting providers or security entities. Despite its current inactive status, residual risk persists due to the potential for re-registration or migration to alternative infrastructure. Users who interacted with the domain prior to its takedown are advised to revoke any connected wallet permissions, monitor for unauthorized transactions, and verify the legitimacy of any future SushiSwap-related communications. Continued vigilance is recommended, as similar impersonation campaigns frequently re-emerge under new domains.