axs-sushi[.]xyz

Analysis of axs-sushi.xyz, observed as a brand‑impersonation site targeting SushiSwap, indicates that the domain was registered on 22 June 2025 through NameSilo, LLC. The public page title returned “Stake SUSHI | Sushi”, matching the declared crypto‑scam focus. DNS resolution points to the IPv4 address 107.172.83.150, an address owned by HostPapa (AS36352) and geolocated to the United States. The TLS certificate presented is labeled R10, and no TLS handshake errors were recorded during the brief connection attempt before the site was taken offline. VirusTotal analysis shows that three of ninety‑three security vendors flagged the domain, and the domain appears on a single external blocklist.

PhishDestroy has actively blocked the domain, and Gridinsoft’s trust scoring system assigns a zero out of one hundred, indicating no trust. The risk level associated with the indicator is elevated, reflecting the convergence of brand impersonation and cryptocurrency deception. As of the report date, the site is listed as offline, preventing direct inspection of the host content. Defenders should continue to block the domain at perimeter firewalls, monitor the associated IP address for any future re‑hosting activity, and incorporate the observed indicators—domain name, IP, SSL fingerprint, and vendor detections—into endpoint detection and response signatures.

Reviewing network logs for outbound connections to 107.172.83.150 and updating URL filtering rules are recommended mitigation steps. The aggregation of registrar data, hosting attribution, low trust score, and multiple vendor detections supports a high confidence assessment that axs-sushi.xyz was employed in a crypto‑related impersonation campaign against SushiSwap users. Internal reference seed 5dd28d documents this case for tracking.