sushi-ondo[.]xyz

Analysis of sushi-ondo.xyz indicates a confirmed crypto‑draining campaign targeting users of the SushiSwap platform. The domain was registered on February 21, 2026 and currently resolves to the IPv4 address 107.172.83.150, which is hosted by HostPapa (AS36352) in the United States. The site’s SSL certificate received an R10 rating, and the Gridinsoft trust score is 0 out of 100, reflecting an extremely low reputation. The page title returned by the server is "Stake SUSHI | Sushi", matching the declared scam type of a crypto scam and the brand impersonation of SushiSwap.

The domain appears on a single security blocklist and is explicitly blocked by PhishDestroy. VirusTotal analysis shows that one of ninety‑three security vendors flagged the domain, providing additional confirmation of malicious intent. The site is presently taken offline, but its infrastructure remains observable and could be re‑activated. Defenders should immediately add sushi-ondo.xyz and its resolved IP address 107.172.83.150 to network‑level deny lists and configure web‑filtering solutions to block any HTTP(S) traffic to the domain.

Endpoint protection platforms should be updated to include the observed indicators, including the low Gridinsoft score and the R10 SSL rating, to improve detection of similar impersonation attempts. Threat‑intelligence teams should monitor registrations of similarly structured domains that reference "Sushi" or "SUSHI" and watch for new hostings under the same AS36352 range, as adversaries may reuse the same hosting provider for future campaigns. Organizations that expose cryptocurrency assets to employees should reinforce user awareness training, emphasizing verification of official SushiSwap URLs and discouraging interaction with unsolicited staking prompts. Continuous review of blocklist feeds and periodic re‑scanning of the domain, should it reappear, will help maintain an up‑to‑date defensive posture against this elevated‑risk threat.