sushiwsap[.]ink

The domain sushiwsap.ink was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is currently hosted on Cloudflare’s network (AS13335) with the IP address 172.67.187.185 located in the United States. DNS resolution points to nicole.ns.cloudflare.com and salvador.ns.cloudflare.com. No TLS certificate was observed, indicating the site was served without HTTPS. HTTP probing shows the service is offline at the time of analysis, which is consistent with recent takedown activity reported by multiple blocklists. Threat intelligence flags the site as a crypto‑scam that impersonates the DeFi platform SushiSwap.

The page title returned from the server – “SushiSwap: Trade Tokens, Earn Rewards & Join DeFi Revolution” – directly mirrors the legitimate brand’s messaging, reinforcing the impersonation claim. VirusTotal scans have recorded three positive detections out of ninety‑three scanners, and the domain appears on three security blocklists. Specific blocklist entries include PhishDestroy, MetaMask, and SEAL, all of which have listed the domain as malicious. Reputation scoring from Gridinsoft assigns a trust score of 0 / 100, indicating an extremely low confidence in legitimacy. The combination of a brand‑matching title, lack of TLS, low trust score, and multiple vendor detections provides strong evidence of a phishing‑oriented campaign targeting cryptocurrency users.

Uncertainty remains around the exact content that was hosted before the takedown, as no live page was captured and no additional indicators such as malicious payload hashes or phishing kit signatures have been released. Analysts should continue to monitor the IP address and associated Cloudflare edge nodes for re‑use, and enforce network‑level blocks against the domain and its resolved IP.