sushi-botto[.]top

Analysis of sushi-botto.top indicates that the domain was registered on 21 February 2026 and is currently offline. DNS resolution points to the IPv4 address 107.172.83.150, which belongs to AS36352 operated by HostPapa and is geolocated in the United States. The site presented an SSL certificate labeled R11, suggesting a self‑signed or low‑trust certificate. The page title returned by the server was “Stake SUSHI | Sushi”, directly referencing the SushiSwap brand, confirming a brand‑impersonation vector aimed at cryptocurrency users. The threat classification in the intelligence set is “Crypto Scam”, consistent with the observed title.

Observational data show that the domain is listed on a single blocklist, PhishDestroy, and has been flagged by two of ninety‑three security vendors on VirusTotal. No additional public blocklists or safe‑browsing services are reported. The limited detection footprint suggests that the campaign may have been short‑lived or that cleanup actions have reduced its visibility. Because the site is offline, active probing cannot confirm the presence of malicious payloads, credential‑stealing forms, or redirection mechanisms; those aspects remain uncertain.

Defenders should continue to monitor the IP address 107.172.83.150 for any resurgence of malicious activity, especially traffic targeting users of SushiSwap or other DeFi platforms. Adding the domain to local deny lists and ensuring that endpoint protection solutions are updated to include the two VirusTotal detections will mitigate inadvertent user exposure. Network defenders are also advised to inspect outbound connections to the HostPapa ASN for anomalous patterns that could indicate reuse of the hosting environment in future campaigns. Continuous verification against threat‑intelligence feeds will help capture any re‑registration attempts that reuse the same branding or similar lexical patterns.