aixbt[.]sushistakes[.]info

This domain, aixbt.sushistakes.info, poses a direct threat as a crypto drainer impersonating the decentralized exchange SushiSwap. The page title, 'Stake AIXBT | Sushi 🍣,' explicitly mimics legitimate SushiSwap staking interfaces, targeting users seeking to stake tokens. Analysis indicates the site is designed to trick victims into connecting their cryptocurrency wallets, enabling malicious smart contracts to execute unauthorized transactions and drain funds. The use of a fake token identifier ('AIXBT') suggests an attempt to exploit users familiar with yield farming or staking mechanisms, increasing the likelihood of successful compromise. Evidence supporting this assessment includes detection by 2 out of 95 security vendors on VirusTotal, a Gridinsoft trust score of 0/100, and presence on one security blocklist. The domain was registered through Cloudflare, Inc., a common registrar for both legitimate and malicious infrastructure, and resolves to the IPv6 address 2606:4700:3030::6815:3fe9. While currently offline, the domain’s infrastructure and impersonation tactics align with known crypto drainer campaigns targeting DeFi platforms. The combination of brand impersonation, low detection rates, and blockchain-based attack vectors elevates the risk profile despite its current inactive status. Users who visited aixbt.sushistakes.info or interacted with its content should immediately revoke any connected wallet permissions via blockchain explorers or wallet management tools. Audit recent transactions for unauthorized activity, particularly those involving the 'AIXBT' token or unfamiliar smart contracts. If funds were transferred, report the incident to the relevant blockchain’s fraud reporting mechanisms and consider filing a report with local cybercrime authorities. Monitor connected wallets for further suspicious activity, as crypto drainers often deploy secondary payloads or retain access through compromised sessions. Avoid reusing passwords or wallet addresses associated with the incident to prevent follow-on attacks.