sushi-link[.]top

Analysis of sushi-link.top shows a high‑risk brand‑impersonation campaign targeting SushiSwap users. The domain was registered on February 21, 2026 and is currently taken offline, but historical evidence indicates active malicious use. The site presented the page title "Stake SUSHI | Sushi," which aligns with the declared crypto‑scam type and confirms the intent to lure victims into staking or depositing SUSHI tokens. Infrastructure data reveals that the domain resolved to IP address 107.172.83.150, hosted in the United States under AS36352 (HostPapa).

The SSL certificate is identified as R11, offering no indication of legitimate ownership. Reputation scoring is extremely low, with Gridinsoft assigning a trust score of 0 out of 100. Detection services have flagged the domain: VirusTotal reports ten of ninety‑five security vendors flagging it as malicious, and four independent blocklists—PhishDestroy, Polkadot, Enkrypt, and Codeesura—have already listed the domain. These indicators collectively demonstrate a coordinated attempt to deceive cryptocurrency users.

Defenders should immediately block the domain and its resolving IP at perimeter and endpoint layers, ensure that any internal references to SushiSwap URLs are validated against known good hashes, and monitor for newly registered domains that use similar lexical patterns or host the same IP range. Continuous threat‑intel feeds should be consulted for any resurgence of the site, and any observed traffic to the IP should be logged and investigated for potential credential harvesting or fund‑drain attempts. Given the offline status, the campaign may be in a rotation phase, so proactive measures are advised to prevent re‑activation.