bnb--sushi[.]xyz

This domain is flagged as a brand‑impersonation crypto scam targeting SushiSwap. The fully qualified domain name bnb--sushi.xyz was registered on 21 February 2026 and is currently taken offline. DNS resolution points to the IP address 172.67.138.62, which belongs to the Cloudflare network (AS13335) located in the United States. The site presented the HTTP title “Just a moment…”, and the TLS certificate presented was identified as “WE1”.

VirusTotal analysis shows that four of ninety‑three scanning engines returned a malicious classification, indicating a non‑trivial detection rate. The domain is listed on four independent blocklists—PhishDestroy, Polkadot, Enkrypt and Codeesura—demonstrating consensus among threat‑intel sources that the address is malicious. The risk rating is elevated, reflecting its use of a reputable brand name to lure cryptocurrency users. At present, no payload samples or phishing page screenshots have been released, so the exact malicious behavior (credential harvesting versus wallet draining) remains uncertain.

The presence of a generic page title suggests a possible redirect or Cloudflare challenge page, but the lack of further HTTP response details prevents definitive attribution. Defenders should block DNS resolution to 172.67.138.62 for the host name bnb--sushi.xyz, add the domain to URL filtering rules, and monitor for any traffic that attempts to contact the domain before its takedown. Security teams should also query threat‑intelligence platforms for updates on the WE1 certificate fingerprint and watch for related domains that reuse the same IP or certificate. Continuous re‑evaluation is recommended in case the infrastructure is re‑hosted or the domain is re‑registered.