sushi-soon[.]xyz

Analysis of the domain sushi-soon.xyz indicates a brand impersonation campaign targeting SushiSwap, a decentralized cryptocurrency exchange. The domain was registered on February 21, 2026, and was active until recently taken offline. Infrastructure analysis reveals it resolved to the IP address 107.172.83.150, hosted on AS36352 (HostPapa) in the United States. The SSL certificate is classified as R11, which may suggest automated or low-trust issuance commonly associated with malicious infrastructure.

At the time of assessment, the page title was recorded as '恭喜，站点创建成功！', which translates to 'Congratulations, site created successfully!'—a generic placeholder often seen in newly deployed or hastily configured phishing environments. While the exact content of the site remains unanalyzed, the domain is explicitly categorized as a crypto scam in available threat intelligence sources. Only 2 out of 93 security vendors on VirusTotal flagged the domain, indicating limited detection coverage at the time of scanning. The domain appears on at least one security blocklist and is blocked by PhishDestroy.

Defenders are advised to treat this domain as malicious and prioritize blocking it at the DNS and network perimeter levels. Given the elevated risk classification and confirmed offline status, organizations should review logs for any prior connections to 107.172.83.150 or sushi-soon.xyz, particularly from users interacting with cryptocurrency platforms. No evidence suggests the use of a known phishing kit, and further forensic analysis of the site content is required to determine the exact mechanism of the scam. The domain’s registration age and rapid takedown suggest a short-lived, opportunistic campaign rather than a long-term infrastructure investment.