alpaca[.]sushi[.]us[.]com

The domain alpaca.sushi.us.com was identified as a phishing site engaged in brand impersonation targeting SushiSwap, a cryptocurrency platform. This scam aimed to deceive users into interacting with fraudulent pages designed to mimic legitimate SushiSwap services, potentially leading to financial loss. No drainer kit was associated with this campaign. The site is currently taken offline, reducing immediate risk to users.

Technical analysis of alpaca.sushi.us.com revealed minimal detection at the time of investigation, with 0 of 95 VirusTotal vendors flagging the domain. Google Safe Browsing also did not flag it. The domain appeared on one security blocklist, PhishDestroy. It was registered through Cloudflare, Inc., and resolved to the IP address 104.21.81.20, hosted by Cloudflare in the US. No SSL certificate was observed, and the page title displayed 'Just a moment...'. Nameservers were not found during the investigation.

Users who interacted with alpaca.sushi.us.com should take immediate steps to secure their assets. For cryptocurrency-related scams, revoke any token approvals granted to unknown contracts and transfer funds to a new wallet. Monitor accounts for unauthorized transactions and enable two-factor authentication (2FA) on all related platforms. Report the phishing domain to relevant authorities, such as the Anti-Phishing Working Group (APWG) or the impersonated brand’s security team, to aid in mitigation efforts.