sandsushi[.]top

sandsushi.top is a phishing domain that impersonates the decentralized finance platform SushiSwap. Despite being taken down, it has already been flagged by 2 out of 92 vendors on VirusTotal, indicating its malicious nature. The domain was listed on three public blocklists, including PhishDestroy, MetaMask, and SEAL, highlighting its threat to users in the cryptocurrency space.

The site was registered through Dynadot LLC and hosted on an IP address associated with CloudFlare, Inc., located in Canada. The SSL certificate was issued by Let's Encrypt, a common choice for phishing domains due to its free and automated nature. The page title, 'Staking | Sushi 🍣', suggests that the attackers aimed to deceive users into believing they were on a legitimate SushiSwap staking page.

Phishing domains like sandsushi.top often exploit the critical 24-72 hour window between domain registration and anti-virus database updates. PhishDestroy's detection pipeline operates upstream of traditional AV vendors, capturing threats during this pre-detection period. The quick takedown of sandsushi.top demonstrates effective threat mitigation, but the initial exposure underscores the need for continuous vigilance in the rapidly evolving threat landscape of cryptocurrency-related phishing attacks.