tkx-sushi[.]xyz

The domain tkx-sushi.xyz has been identified as a brand impersonation threat specifically targeting users of the decentralized exchange SushiSwap. This fraudulent site was designed to mimic SushiSwap's legitimate platform, likely employing a crypto drainer kit to steal wallet credentials and digital assets from unsuspecting visitors. The domain's name directly references the real brand, a common tactic in phishing campaigns to deceive users.

Technical indicators paint a clear picture of malicious intent. VirusTotal analysis shows that 11 out of 95 security vendors flag this domain as malicious, a significant detection rate that underscores its dangerous nature. The domain was registered through NameSilo, LLC on June 28, 2025, and currently appears on 5 separate security blocklists. While the specific IP address is not provided, the combination of high vendor flagging and blocklist presence strongly suggests active hosting on infrastructure known for fraud. Additionally, the domain does not appear on Google Safe Browsing's blocklist, which means some users might not receive browser warnings before visiting.

As of the latest analysis, tkx-sushi.xyz is offline, indicating that hosting providers or registrars have taken action to suspend the site. However, the domain remains registered and could be reactivated or redirected to new infrastructure. Users who may have visited this site should take immediate precautions: revoke any permissions granted to the site, transfer funds from any connected wallets to new addresses, and enable two-factor authentication on all crypto accounts. PhishDestroy recommends always verifying URLs directly through official SushiSwap channels and avoiding clicking links from unsolicited messages. Stay vigilant, as similar phishing domains targeting DeFi brands continue to emerge.