sushi-vista[.]xyz

Analysis of sushi-vista.xyz shows a newly registered domain (creation date 2026-02-21) that was used to impersonate the SushiSwap brand. The site presented the page title "Stake SUSHI | Sushi," indicating a focus on the SushiSwap staking service. DNS resolution points to the IP address 107.172.83.150, which is owned by HostPapa (AS36352) and geolocated in the United States. The domain employed an SSL certificate identified as R11, confirming that HTTPS was active at the time of observation.

Threat intelligence aggregators flagged the domain, with nine of ninety‑five VirusTotal scanners labeling it malicious. It appears on two external blocklists and is actively blocked by PhishDestroy and ScamSniffer, both of which categorize the activity as a crypto scam. The domain’s current status is offline, which suggests the operators have taken the site down or moved the infrastructure. However, the existing evidence—brand‑specific page title, IP ownership, SSL usage, and multiple vendor detections—indicates that the domain was deliberately crafted to lure users seeking SushiSwap services, likely to harvest credentials or funds.

Defenders should continue to block the IP address 107.172.83.150 and add sushi-vista.xyz to domain‑based deny lists. Monitoring for re‑registration or similar look‑alike domains is advised, as threat actors often reuse hosting providers and certificate authorities. Organizations that integrate SushiSwap should educate users about the legitimate URL patterns and encourage verification of TLS certificates before interacting with staking pages. The combination of brand impersonation, confirmed crypto‑scam classification, and multiple security vendor detections underscores the elevated risk posed by this infrastructure, even though the site is presently offline.