sushi-gray[.]top

Analysis of the domain sushi-gray.top indicates it was actively impersonating the decentralized exchange SushiSwap, targeting users with a fraudulent staking scheme. The domain was registered on July 13, 2025, through NameSilo, LLC, and resolved to the IP address 107.172.83.150, hosted on AS36352 (HostPapa) in the United States. The SSL certificate was issued by Let's Encrypt (R11), a common choice for both legitimate and malicious infrastructure. At the time of assessment, the page title displayed 'Stake SUSHI | Sushi,' directly referencing the SUSHI token and the SushiSwap brand, confirming the intent to deceive users into believing the site was an official staking portal.

Security vendor detections were mixed but indicative of malicious activity: seven of 93 vendors on VirusTotal flagged the domain as malicious. The domain appeared on four security blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura, further supporting its classification as a crypto scam. Gridinsoft assigned a trust score of 0/100, reinforcing the high-risk nature of the infrastructure. The domain has since been taken offline, though historical resolution and detection data remain relevant for threat correlation.

Defenders should treat this domain as part of a broader pattern of SushiSwap impersonation campaigns. Network-level blocks should be implemented for the IP 107.172.83.150 and associated domains registered through NameSilo during the same period. While the exact content of the phishing page is not yet analyzed, the combination of brand impersonation, staking-themed page title, and crypto scam classification suggests it likely solicited wallet connections or token deposits under false pretenses. Monitoring for newly registered domains with similar naming patterns (e.g., 'sushi-[adjective].top') and resolving to the same IP or ASN may help preempt future iterations of this campaign.