sushi-ilv[.]top

Analysis confirms that sushi-ilv.top is an active brand‑impersonation infrastructure targeting users of the SushiSwap decentralized exchange. The domain was registered on 21 February 2026 and presently resolves to the IPv4 address 107.172.83.150, which is hosted in the United States under ASN 36352 (HostPapa). The server presents an SSL certificate identified as “R10”, indicating that encrypted HTTPS connections are offered despite the site being taken offline at the time of observation. The public page title retrieved from the site reads “Stake SUSHI | Sushi”, matching the crypto‑scam narrative supplied in the intelligence. The domain is flagged as a crypto‑scam and explicitly impersonates SushiSwap.

Two of ninety‑three VirusTotal scanners flagged the domain, confirming malicious classification by multiple vendors. Independent blocklists also list the domain: PhishDestroy has added it, and it appears on one additional security blocklist. Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious assessment. The risk level is designated as elevated. Defenders should immediately block resolution of sushi‑ilv.top and its hosting IP 107.172.83.150 at perimeter and DNS filtering points.

The SSL certificate should be denied for any internal service that validates certificates against known trust anchors. Monitoring should be extended to newly created domains that resolve to the same ASN or share the “R10” certificate fingerprint. Because the site is offline, no further HTTP response details are available; analysts should continue to query the domain for any re‑activation attempts and capture full page content if the site resurfaces. Correlation with other SushiSwap‑related phishing campaigns may reveal shared tooling or command‑and‑control infrastructure. Continuous review of VirusTotal and other multi‑engine scanners is recommended to capture any future detection changes.