sushi-biden[.]top

Analysis of the domain sushi-biden.top, created on 13 July 2025 and currently taken offline, shows a clear pattern of brand impersonation targeting SushiSwap. The site’s HTML title “Stake SUSHI | Sushi” aligns with the declared crypto‑scam type and suggests an attempt to lure users into staking or depositing SUSHI tokens. Registration details indicate the domain was purchased through NameSilo, LLC, and the hosting IP resolves to 107.172.83.150, an address owned by HostPapa (AS36352) located in the United States. The infrastructure has been flagged by four independent blocklists—PhishDestroy, Polkadot, Enkrypt, and Codeesura—demonstrating that multiple threat‑intelligence feeds have identified it as malicious.

Additionally, Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious reputation. VirusTotal analysis shows that one out of ninety‑three scanning engines marked the domain as malicious, providing a minimal but corroborating detection signal. The SSL certificate is listed as R10, which does not meet standard validation criteria for legitimate financial services. Because the site is offline, active probing is not possible, but the historical evidence suggests a short‑lived phishing infrastructure designed to harvest cryptocurrency credentials.

Defenders should block the domain at perimeter firewalls, update DNS filtering policies to include the listed blocklists, and monitor for any residual traffic to the associated IP address. Incident response teams should also search for related IoCs such as the registrar NameSilo, the hosting ASN, and the specific page title string. Continuous vigilance is advised, as the operators may recycle the same registration and hosting patterns for future campaigns.