sushi-grt[.]top

Analysis of sushi-grt.top indicates a brand-impersonation campaign targeting SushiSwap users. The domain was registered on 21 February 2026 and, as of the report date, is taken offline after being blocked by PhishDestroy, Polkadot, Enkrypt and Codeesura. DNS resolution points to 107.172.83.150, an address owned by AS36352 (HostPapa) located in the United States. The site presented an R11 SSL certificate, a standard TLS certificate without extended validation, which does not provide any additional trust. VirusTotal scans show nine of ninety‑three security vendors flagging the domain as malicious, reinforcing the suspicion of abuse.

Four security blocklists currently list the domain, and the same four blocklists are also reflected in the blocklist count. The page title returned from the HTTP response is "Stake SUSHI | Sushi", directly referencing the SushiSwap brand and confirming the declared impersonation intent. The scam type is identified as a crypto‑scam, consistent with the use of the Sushi token name in the title. No further content, login forms, or credential‑harvesting mechanisms have been publicly disclosed, leaving the exact payload and victim‑interaction flow uncertain.

The hosting provider HostPapa is a popular shared‑hosting service, which may host unrelated legitimate sites; therefore, remediation should focus on the specific domain and IP rather than broad provider blocking. Defenders should continue to block the domain at DNS and proxy layers, add the associated IP address to network‑level deny lists, and monitor for any new subdomains or similarly crafted domains that reference SushiSwap or the Sushi token. Updating detection signatures with the observed page title and SSL fingerprint can improve early identification of related campaigns. Continuous review of blocklist feeds and VirusTotal alerts is recommended to capture any re‑activation attempts.