sushi-cheems[.]top

Analysis of sushi-cheems.top reveals infrastructure consistent with a crypto-themed phishing operation targeting users of the decentralized exchange SushiSwap. The domain, registered on July 5, 2025, through NameSilo, LLC, resolved to IP address 107.172.83.150, hosted on AS36352 (HostPapa) in the United States. As of July 22, 2026, the domain is offline, though prior activity included a page titled 'Stake SUSHI | Sushi,' directly referencing SushiSwap’s native token and staking functionality. Three out of 93 security vendors on VirusTotal flagged the domain as malicious, and it appears on at least one security blocklist (PhishDestroy).

The domain’s SSL certificate (R11) and registration with a low-cost registrar are common traits in phishing infrastructure, though not inherently incriminating. Gridinsoft assigned a trust score of 0/100, reinforcing its classification as a likely scam. The reported scam type—crypto scam—aligns with the page title and brand impersonation of SushiSwap, a known target for fraudulent staking or token-drain schemes. Defenders should treat this domain as a confirmed phishing threat, particularly for users interacting with DeFi platforms.

While the site is currently offline, historical resolution to 107.172.83.150 and associated indicators (e.g., registrar, ASN) may aid in identifying related infrastructure. No evidence links this domain to a specific phishing kit or additional threat actors. Organizations should monitor for re-registration under similar naming conventions or reuse of the IP address for other malicious domains.