axl-sushi[.]xyz

This domain, axl-sushi.xyz, is flagged as a brand impersonation threat targeting SushiSwap, a decentralized finance protocol. Analysis indicates the domain was specifically designed to mimic legitimate SushiSwap staking interfaces, as evidenced by the page title 'Stake SUSHI | Sushi.' The objective appears to be credential harvesting or direct cryptocurrency theft through fraudulent staking prompts, a tactic commonly associated with drainer kits in the DeFi space. No explicit drainer kit signature was identified, but the domain's structure and content align with known phishing campaigns targeting decentralized exchange users. Infrastructure analysis reveals the domain was registered on June 22, 2025, through NameSilo, LLC, a registrar frequently utilized in low-cost domain registrations for malicious purposes. The domain resolves to the IP address 107.172.83.150, which has been linked to other suspicious activities in recent threat intelligence reports. Detection metrics show 4 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on one security blocklist. Google Safe Browsing status is not explicitly provided, but the limited detection rate suggests either a new or evasive campaign designed to avoid widespread flagging. As of the latest assessment, axl-sushi.xyz has been taken offline, likely in response to security vendor detections or hosting provider intervention. However, the elevated risk level persists due to the domain's recent creation and the potential for infrastructure reuse. Users who interacted with the domain prior to its takedown should assume credential or asset compromise and take immediate remediation steps, including revoking wallet permissions, rotating passwords, and monitoring for unauthorized transactions. Organizations are advised to update blocklists with the domain and IP address to prevent future access attempts. The remaining risk includes the possibility of the threat actors re-deploying the phishing kit under a newly registered domain.