sushi-avax[.]top

The domain sushi-avax.top was registered on February 21, 2026 through NameSilo, LLC. It resolves to the IPv4 address 107.172.83.150, which belongs to AS36352 hosted by HostPapa in the United States. The authoritative nameservers are ns1.ns306.parklogic.com. and ns2.ns306.parklogic.com., and the site returns HTTP 200 with an SSL certificate identified as R10.

The site presents the page title “Stake SUSHI | Sushi”, directly referencing the SushiSwap brand and indicating a cryptocurrency‑related impersonation campaign. VirusTotal analysis shows that eight of ninety‑five scanners have flagged the domain as malicious. It is currently listed on four public blocklists and has been blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura, reinforcing its classification as a high‑risk brand‑impersonation vector.

Risk assessment assigns a high confidence level to the threat, consistent with the observed indicators: recent registration, active hosting, valid TLS, and active blocklist listings. The infrastructure appears uncomplicated, but no additional payload or credential‑stealing pages have been publicly disclosed, leaving the exact phishing mechanics uncertain. The presence of a legitimate‑looking page title suggests an attempt to lure SushiSwap users to a fraudulent staking interface.

Defenders should immediately block or sinkhole sushi-avax.top at network perimeters and update detection rules to flag any outbound connections to the resolved IP address. Continuous monitoring of the associated IP and the hosting provider AS36352 is advised, as adversaries frequently shift domains within the same host. Threat‑intel feeds should be refreshed with the current blocklist entries, and any related traffic should be logged for forensic correlation.