xaut[.]sushi-cc[.]lol

Analysis of the domain xaut.sushi-cc.lol, first observed on November 28 2025, indicates a confirmed crypto‑scam infrastructure that impersonates the SushiSwap platform. The site was registered through Dynadot LLC and is currently taken offline, but historic DNS records show it was served from the IP address 172.67.216.201, which belongs to Cloudflare, Inc. (AS13335) and is geolocated to the United States. The domain’s authoritative nameservers are ashley.ns.cloudflare.com and denver.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service. No TLS certificate was associated with the site, implying that HTTPS was not enforced at the time of capture.

The page title returned by the server was “Staking | Sushi 🍣”, directly referencing the target brand and suggesting a fraudulent staking lure. Security reputation systems have flagged the domain on two independent blocklists, specifically PhishDestroy and ScamSniffer. VirusTotal scans recorded detections from 11 of 93 security vendors, reinforcing the malicious classification. A Gridinsoft trust score of 0 out of 100 further reflects the absence of any benign reputation.

The evidence collectively points to a brand‑impersonation campaign designed to lure cryptocurrency users into a fake staking interface. Uncertainty remains regarding the exact payload delivered to victims, as the site content has not been archived and no sample URLs were captured before takedown. Defenders should block the domain at the DNS and proxy layers, monitor for any residual traffic to the associated Cloudflare IP, and update detection rules to include the observed page title and the specific combination of nameservers. Continuous threat‑intel feeds should be consulted for any re‑registration attempts using similar sub‑domains or the same registrar, and incident response teams should advise users to verify the authenticity of SushiSwap communications through official channels.