gmt-sushi[.]cfd

The domain gmt-sushi.cfd is a phishing site engaged in brand impersonation targeting users of the cryptocurrency platform SushiSwap. It presents itself as a legitimate staking portal for SUSHI tokens but is designed to steal credentials or funds from victims. As of the latest verification, gmt-sushi.cfd has been taken offline, though it previously posed an elevated risk as a cryptocurrency scam.

Technical analysis of gmt-sushi.cfd reveals limited but notable detection. The domain was flagged by 2 of 95 security vendors on VirusTotal, including alphaMountain.ai and Webroot. It appears on 4 security blocklists, specifically PhishDestroy, Polkadot, Enkrypt, and Codeesura. The domain was created on February 21, 2026, and resolved to the IP address 107.172.83.150, hosted by AS36352 (HostPapa) in the US. The SSL certificate was issued by R10, and the observed page title was 'Stake SUSHI | Sushi'. Gridinsoft and Scamadviser assigned trust scores of 0/100 and 1/100, respectively, further indicating its malicious nature.

Users who interacted with gmt-sushi.cfd should immediately revoke any token approvals granted to unknown contracts and transfer funds to a new wallet. If credentials were entered, change passwords on the legitimate SushiSwap platform and enable two-factor authentication. Report the phishing domain to platforms like Google Safe Browsing, PhishTank, or the impersonated brand’s security team to aid in takedown efforts.