sushi[.]support

Analysis of the domain sushi.support, registered on 21 February 2026, shows that it resolves to the Amazon‑owned IP address 216.198.79.1 located in the United States and advertised as part of AS16509. The site currently returns an offline HTTP response, and its SSL certificate is identified as R11. The page title retrieved from the last known snapshot reads “Sushi.support - Premium Domain for Sale | Perfect for Sushi Restaurant Support Services”, which does not reference the targeted brand but the domain is explicitly listed as impersonating SushiSwap in the provided intelligence. The threat is classified as a crypto‑related scam, and the domain appears on a single security blocklist and is blocked by PhishDestroy.

Reputation services assign very low scores: Scamadviser reports a trust rating of 5 / 100, and Gridinsoft records a score of 0 / 100. VirusTotal analysis shows that five of ninety‑three scanners flagged the domain, indicating at least partial detection of malicious characteristics. The domain is also referenced in one AlienVault OTX pulse, confirming its inclusion in broader threat‑intel feeds. The combination of a newly created domain, low reputation scores, association with a known brand impersonation campaign, and detection by multiple vendors suggests a heightened risk of credential harvesting or crypto‑draining activity, even though the site is presently offline.

Uncertainty remains regarding the exact payload or phishing infrastructure because no active content was captured and the page title does not reveal a login portal. Defenders should add the domain and its resolving IP to network‑level block lists, monitor DNS queries for future re‑activation, and ensure that any user‑facing services that interact with SushiSwap credentials employ strict domain validation and multi‑factor authentication. Continuous ingestion of updates from blocklist providers, OTX, and VirusTotal will be required to capture any re‑emergence of the domain.