sushi-ethfi[.]top

Analysis indicates that the domain sushi-ethfi.top was registered on 2026-02-21 and actively resolves to the IPv4 address 107.172.83.150, which is announced by AS36352 hosted by HostPapa in the United States. The site presents the page title “Stake SUSHI | Sushi”, a phrasing that aligns with a crypto‑staking narrative and directly references the SushiSwap brand, confirming the impersonation intent. The SSL certificate is rated R10, providing only minimal cryptographic assurance and offering no protection against credential harvesting. VirusTotal scans show that two of ninety‑five security engines flagged the domain, and the domain appears on one external blocklist.

Gridinsoft assigns a trust score of 0 out of 100, indicating a high likelihood of malicious activity. PhishDestroy has already taken the site offline, and the current status is recorded as offline. The available data point to a crypto‑scam operation that leverages the SushiSwap brand to lure victims into staking SUSHI tokens. Uncertainty remains regarding the specific payload or credential‑capture mechanisms because the page content has not been captured.

Defenders should add the IP address 107.172.83.150 to deny‑list rules, monitor DNS queries for sushi-ethfi.top, and enforce blocklist entries from PhishDestroy and any other threat‑intel feeds that reference this domain. Network intrusion detection signatures should be tuned to alert on HTTP requests containing the page title “Stake SUSHI | Sushi”. Endpoint protection should flag any executable or script downloads originating from the associated IP, and SOC analysts should investigate any recent authentication attempts to SushiSwap services that originate from the same infrastructure.