sushi-sahara[.]top

Analysis of the domain sushi-sahara.top indicates it was actively involved in a cryptocurrency phishing operation impersonating SushiSwap, a decentralized finance platform. The domain was registered on February 21, 2026, and resolved to the IP address 107.172.83.150, hosted on AS36352 by HostPapa in the United States. The SSL certificate was classified as R11, a low-assurance type commonly associated with short-lived phishing sites. The page title, 'Stake SUSHI | Sushi,' directly references the SUSHI token and the SushiSwap brand, confirming the impersonation target. Security vendors have flagged this domain with low trust scores: Gridinsoft assigned a trust score of 0/100, and Scamadviser rated it 46/100.

The domain appears on at least one security blocklist and is specifically blocked by PhishDestroy. Three out of 93 security vendors on VirusTotal detected the domain as malicious. The site was classified as a crypto scam, though the exact mechanics—such as whether it functioned as a token drainer, fake staking portal, or wallet credential harvester—remain unconfirmed due to the lack of detailed behavioral analysis. As of the report date, the domain is offline, reducing immediate risk to end users.

However, infrastructure analysis reveals that the hosting provider and IP range have previously supported other phishing campaigns, suggesting a pattern of abuse. Defenders should monitor related IP space and domain registrations under the same registrar for signs of re-emerging activity. Organizations should also update blocklists to include this domain and its associated IP to prevent potential re-use. While the domain is no longer active, historical logs should be reviewed for connections from internal networks to identify any prior exposure.