sushi-gray[.]xyz

The domain sushi-gray.xyz was registered on February 21, 2026 and is currently listed as offline. DNS resolution points to IP address 107.172.83.150, which is hosted by HostPapa under ASN 36352 in the United States. The site presented the page title "恭喜，站点创建成功！" ("Congratulations, site created successfully!") and is identified as impersonating the SushiSwap brand, indicating a targeted crypto‑scam attempt. Security telemetry shows that two of ninety‑three VirusTotal scanners flagged the domain, and it is blocked by the PhishDestroy service.

Additionally, the domain appears on one external blocklist, confirming that at least one independent security feed has marked it as malicious. The SSL certificate associated with the site is labeled R11, a low‑trust indicator that often accompanies fraudulent infrastructure. While the available data confirm the domain’s association with a crypto‑focused impersonation campaign against SushiSwap users, the exact content served, such as credential‑stealing forms or malicious payloads, has not been captured because the site is offline.

Consequently, the full scope of the threat—whether it attempted credential harvesting, transaction redirection, or other malicious activity—remains uncertain. Defenders should immediately block the domain and the hosting IP address at perimeter and DNS layers, add the associated hash of the SSL certificate to internal reputation lists, and monitor for any new domains that resolve to the same IP or share the R11 certificate pattern. Continuous watch for related indicators of compromise, including similar brand‑impersonating domains, will help mitigate potential re‑use of this infrastructure in future crypto‑scam campaigns.