why-sushi[.]xyz

Analysis of the domain why-sushi.xyz shows a clear pattern of brand impersonation aimed at SushiSwap users. The domain was registered on February 21, 2026 and resolves to the IP address 107.172.83.150, which is hosted in the United States under ASN 36352 (HostPapa). The site presented the page title "Stake SUSHI | Sushi," aligning with the declared scam type of a crypto scam and the brand target SushiSwap.

A Gridinsoft trust score of 0 out of 100 indicates the lowest possible reputation, and the SSL certificate received an R10 rating, further suggesting poor security posture. VirusTotal scans identified the domain as malicious in 8 of 93 security vendor engines, providing independent corroboration of its abusive nature. The domain appears on a single security blocklist and has been actively blocked by PhishDestroy, confirming that threat intelligence feeds have recognized it as hostile.

Current monitoring shows the domain is offline, and the status field explicitly notes that it has been taken offline, which may be the result of takedown actions or hosting suspension. While the exact content of the site was not captured, the combination of brand-targeted page title, low trust scores, vendor detections, and blocklist listings provides sufficient evidence to classify the domain as a confirmed crypto brand impersonation threat. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of similar domains using the same brand keywords, and update endpoint and web filtering policies to include the observed indicators of compromise, including the IP address 107.172.83.150 and the SSL fingerprint associated with the R10 certificate.