sushi-andy[.]xyz

Analysis of the domain sushi-andy.xyz indicates it was actively impersonating the decentralized exchange SushiSwap, specifically targeting users with a fraudulent staking interface. The domain, registered on February 21, 2026, through NameSilo, LLC, resolved to the IP address 107.172.83.150, hosted on AS36352 (HostPapa) in the United States. Cloudflare nameservers (celine.ns.cloudflare.com and lex.ns.cloudflare.com) were in use, and the SSL certificate was issued under the R10 root, a configuration commonly observed in phishing infrastructure leveraging Cloudflare services. The page title, 'Stake SUSHI | Sushi,' directly references SushiSwap’s native token and staking functionality, aligning with the scam type classified as a crypto scam.

Detection by security vendors remains limited but notable: eight of 95 engines on VirusTotal flagged the domain as malicious at the time of assessment, and it appeared on one security blocklist, including PhishDestroy. Trust scores from Gridinsoft and Scamadviser both assigned the lowest possible rating (0/100 and 1/100, respectively), reinforcing its high-risk classification. As of July 24, 2026, the domain is offline, though its prior infrastructure and registration details remain relevant for historical tracking.

Defenders should treat any prior resolution of this domain as malicious and assess logs for connections to 107.172.83.150 or interactions with the 'Stake SUSHI | Sushi' page title. While the exact content of the site is not yet analyzed, the combination of brand impersonation, low trust scores, and detection by multiple security vendors confirms its use in a targeted crypto scam. Further monitoring of related infrastructure, particularly domains registered through NameSilo or resolving to HostPapa’s AS36352, is recommended.