puffer-sushi[.]xyz

On 22 July 2026 analysts observed that the domain puffer-sushi.xyz resolves to the IP address 172.67.176.206, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The domain was registered through Namecheap on 18 August 2025 and is currently taken offline. The site presents a page title of “Cierpliwości…”, but no further content has been captured. Gridinsoft assigned a trust score of 0 out of 100, indicating a high confidence of malicious intent.

The SSL certificate presented by the host is identified as “WE1”, a certificate type often associated with low‑trust or improperly issued certificates. VirusTotal analysis shows that five of ninety‑three scanning engines flagged the domain as malicious, reinforcing the suspicion of a crypto‑related scam. The domain appears on four public blocklists, specifically PhishDestroy, Polkadot, Enkrypt, and Codeesura, all of which categorize it as a brand impersonation targeting SushiSwap. The intelligence tags the activity as a “Crypto Scam”, confirming that the operator attempts to exploit the SushiSwap brand for financial gain.

Given the combination of a zero trust score, multiple blocklist listings, and partial detection by reputable scanning vendors, defensive teams should add puffer-sushi.xyz to their deny‑list, monitor DNS queries for the associated IP address, and enforce strict outbound filtering to prevent connections to this host. Continuous observation of new domains registered through the same registrar and sharing the same Cloudflare AS number is advised, as threat actors frequently recycle infrastructure. Because the site is offline, further forensic collection is limited, but the existing indicators provide sufficient evidence to classify the domain as a confirmed crypto brand‑impersonation threat.