paalsushi[.]top

Analysis of paalsushi.top indicates an active brand impersonation campaign targeting SushiSwap, a decentralized finance platform. The domain was registered on May 18, 2026, through Dynadot LLC and currently resolves to 188.114.97.3, a Cloudflare IP address located in Canada. The site returns an HTTP 302 redirect status, suggesting it may be funneling visitors to another malicious endpoint or preparing for further exploitation. Infrastructure is protected by Cloudflare nameservers (buck.ns.cloudflare.com, emily.ns.cloudflare.com) and a Let's Encrypt SSL certificate, which is consistent with threat actors leveraging legitimate services to evade detection. The page title, 'Staking | Sushi 🍣', directly references SushiSwap's branding and functionality, reinforcing the impersonation vector. Multiple security vendors have flagged the domain: it appears on three blocklists, including PhishDestroy, MetaMask, and SEAL, and is referenced in one AlienVault OTX threat intelligence pulse. Gridinsoft assigns a trust score of 0/100, further corroborating its malicious classification. While VirusTotal reports two detections out of 92 vendors, this does not diminish the domain's confirmed status as an active threat. Defenders should treat paalsushi.top as high-risk and prioritize blocking or monitoring traffic to this domain. The use of Cloudflare infrastructure and a short registration window (under two months) aligns with common phishing tactics to minimize exposure before takedown. No evidence currently links this domain to a specific phishing kit or broader campaign, but its focus on staking suggests an intent to exploit users seeking cryptocurrency rewards. Further investigation into associated IP ranges and redirect chains is recommended to identify secondary infrastructure.