beam-sushi[.]cc

This investigation documents the infrastructure associated with the domain beam-sushi.cc, which was observed targeting users of the SushiSwap platform through a brand‑impersonation campaign. The domain was registered on 25 June 2025 via NameSilo, LLC and is hosted on a server identified as 107.172.83.150, belonging to AS36352 (HostPapa) located in the United States. The site presented the page title “Stake SUSHI | Sushi”, reinforcing the intended association with the SushiSwap brand and indicating a crypto‑focused scam. The SSL certificate in use carries an R10 rating, which suggests a low trust level, and the Gridinsoft trust score for the domain is 0 out of 100.

VirusTotal scans returned nine positive detections out of ninety‑three security vendors, confirming that multiple tools classify the domain as malicious. Additionally, the domain appears on four independent security blocklists and is explicitly blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura. The site’s current HTTP status is offline, which limits further content analysis, but the available evidence already demonstrates a clear intent to deceive SushiSwap users into submitting cryptocurrency credentials or funds.

Uncertainty remains regarding the full payload delivered to victims, the exact phishing kit employed, and whether any additional infrastructure (e.g., command‑and‑control servers) is linked to the same IP address. Defenders should update web‑filtering and DNS‑sinkhole rules to block beam‑sushi.cc, monitor for any new subdomains resolved to the same IP range, and incorporate the domain hash into threat‑intel feeds. Organizations using SushiSwap should alert their users to the offline but previously active impersonation site and reinforce best practices for verifying URLs and avoiding unsolicited staking requests.