yala[.]sushiswap[.]it[.]com

The domain yala.sushiswap.it.com is currently under investigation for brand impersonation, specifically targeting the decentralized exchange SushiSwap. This threat is not merely generic phishing activity; it is a focused attempt to deceive users by mimicking a legitimate DeFi brand. The domain has been taken offline, but its risk level remains under investigation as analysts assess the full scope of the campaign.

PhishDestroy identified several key data points that paint a concerning picture. The domain was registered through UK Intis Telecom Ltd, and its creation date dates back to October 23, 1992, which is unusual for a phishing domain and may indicate a compromised older domain or a deliberate attempt to appear legitimate. The IP address 188.114.96.3 is associated with the domain, and VirusTotal shows 0 out of 95 security vendors detecting the domain, meaning it has not yet been widely flagged. However, it appears on 1 security blocklist, indicating that some threat intelligence sources have already identified it as suspicious. The page title captured was "Just a moment...", a common placeholder that suggests the site may have been under construction or using a verification gate to evade detection.

For users who may have encountered this domain, immediate actions are recommended. Since this is a brand impersonation targeting SushiSwap, users should avoid clicking any links or entering credentials on the site. If any personal information or wallet keys were submitted, those accounts should be considered compromised immediately. Users should enable two-factor authentication on their legitimate SushiSwap accounts and monitor for unauthorized transactions. PhishDestroy advises reporting the domain to relevant security teams and blocklisting the IP 188.114.96.3 if possible. Always verify URLs directly through official SushiSwap channels before interacting with any DeFi platforms.