app[.]v1-llamaswap[.]run

The domain app.v1-llamaswap.run was registered through NiceNIC International Group Co., Limited on December 18, 2025. It resolves to the Cloudflare‑owned address 188.114.96.3, which is announced by AS13335 Cloudflare, Inc. and geolocated to the United States. The domain is served without an SSL certificate, indicating that only unencrypted HTTP connections are possible. DNS resolution is handled by the Cloudflare name servers bingo.ns.cloudflare.com and curt.ns.cloudflare.com, a common configuration for fast‑fluctuating malicious infrastructure.

VirusTotal analysis shows that four of ninety‑five security vendors flagged the domain, providing limited but notable detection. Gridinsoft assigns a trust score of zero out of one hundred, and the domain appears on a single external security blocklist. PhishDestroy has already blocked the site, and the current operational status is offline, with the HTTP response presenting the page title "Access Denied." The threat classification in the intelligence is a crypto‑related scam, consistent with the "Crypto Scam" label supplied. The elevated risk rating reflects the combination of recent registration, low trust score, partial vendor detections, and the use of a high‑profile CDN to obscure true hosting.

Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms, as no further content analysis is available. Defenders should add the domain and its resolved IP address to network deny lists, monitor for any DNS changes that could reactivate the domain, and incorporate the associated name servers into threat‑intel feeds. Continuous observation of Cloudflare‑hosted indicators is advised, as adversaries often pivot to new subdomains under the same infrastructure.