sushi-form[.]top

Analysis of the domain sushi-form.top indicates it was actively impersonating the decentralized exchange SushiSwap, targeting users with a crypto scam. The domain, registered on July 15, 2025, through NameSilo, LLC, resolved to IP address 107.172.83.150, hosted on AS36352 (HostPapa) in the United States. The SSL certificate was issued under the R10 root, a detail often observed in short-lived phishing infrastructure. At the time of assessment, the site's page title was 'Stake SUSHI | Sushi,' directly referencing the SUSHI token and the SushiSwap platform, reinforcing the brand impersonation intent.

Security vendor detection on VirusTotal showed 7 of 93 engines flagging the domain, a modest but notable signal given the domain's offline status at the time of this report. The domain appeared on at least one security blocklist and was blocked by PhishDestroy. Gridinsoft assigned a trust score of 0 out of 100, further indicating malicious classification. While the exact content and functionality of the site remain unconfirmed due to its offline status, the available metadata—including registration timing, hosting provider, and page title—aligns with known patterns of crypto-focused phishing operations.

Defenders should treat this domain as compromised infrastructure. Although it is currently inactive, historical DNS and WHOIS records should be preserved for potential incident response or takedown coordination. Security teams are advised to monitor for re-registration or reuse of the domain, as well as related infrastructure under the same ASN or registrar. No evidence suggests this domain was part of a broader campaign, but correlation with other SushiSwap-themed phishing domains may reveal additional threats.