yala[.]sushiswap[.]onl

The domain yala.sushiswap.onl is a confirmed phishing site engaged in brand impersonation targeting users of the cryptocurrency platform SushiSwap. It was designed to deceive victims into believing they were interacting with the legitimate SushiSwap service, likely to steal cryptocurrency through fraudulent transactions. No drainer kit was identified in this campaign. As of the latest verification, yala.sushiswap.onl has been taken offline, though users who previously visited the site may still be at risk.

Technical indicators confirm the malicious nature of yala.sushiswap.onl. The domain was flagged by 2 of 95 security vendors on VirusTotal, including Fortinet and SOCRadar, and appears on 1 security blocklist (PhishDestroy). It was registered through Dynadot LLC on September 15, 2025, and resolved to the IP address 188.114.97.3, hosted on Cloudflare's network (AS13335). No SSL certificate was available, and the observed page title was 'Just a moment...'. The domain used Cloudflare nameservers: brenna.ns.cloudflare.com and hassan.ns.cloudflare.com.

Users who interacted with yala.sushiswap.onl should immediately revoke any token approvals granted to unknown contracts and transfer remaining funds to a new wallet. Enable two-factor authentication on all cryptocurrency accounts and monitor for unauthorized transactions. Report the phishing domain to the impersonated brand (SushiSwap) and relevant platforms such as Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to aid in broader takedown efforts.