omikami[.]sushi-cn[.]biz

On July 25, 2026, the domain omikami.sushi-cn.biz was observed as an offline cryptocurrency‑related impersonation site targeting SushiSwap. The domain was registered on October 31, 2025 through Dynadot LLC and resolves to the IP address 172.253.62.147, which belongs to AS15169 Google LLC in the United States. DNS resolution is served by the Cloudflare name servers apollo.ns.cloudflare.com and meera.ns.cloudflare.com. No TLS certificate is presented; HTTP requests receive no response because the site is currently taken offline. The only visible HTML title returned from the server is “Google”, providing no direct indication of malicious content.

Threat intelligence categorises the activity as a crypto scam that attempts to mimic SushiSwap, though the exact phishing page content has not been captured. The domain appears on one security blocklist and has been blocked by the PhishDestroy feed. On VirusTotal, four of ninety‑five scanners flagged the domain, confirming a low‑to‑moderate detection rate. Gridinsoft assigned a trust score of 0 out of 100, indicating a highly untrusted reputation.

The combination of a recent registration, association with a major cloud provider’s IP range, lack of SSL, and multiple vendor detections strongly suggests malicious intent despite the current offline state. Defenders should add the fully qualified domain name to DNS and proxy blocklists, monitor for any future re‑activation of the IP address, and enforce strict outbound filtering for connections to 172.253.62.147. Continuous re‑scanning with VirusTotal and inclusion in internal URL reputation services is recommended to capture any changes in the domain’s status. Because the page title is generic and the site is offline, the precise payload or credential‑stealing mechanism remains unknown; threat hunters should remain vigilant for related SushiSwap‑themed phishing campaigns that may reuse the same infrastructure.