llamasaswap[.]com

The domain llamasaswap.com has been identified as a high-risk brand impersonation threat specifically targeting Gmail users through credential theft tactics. Analysis confirms the domain is currently offline, though it previously operated as an active phishing infrastructure mimicking Google's login interface with the page title 'Google.' This campaign aligns with known patterns of credential harvesting rather than cryptocurrency drainer activity. Infrastructure analysis reveals the domain was registered on July 23, 2025, through Dynadot LLC and resolved to the IP address 142.250.185.228, hosted on Google LLC's autonomous system (AS15169). Security telemetry shows 14 of 95 VirusTotal vendors flagged the domain as malicious, while Google Safe Browsing classified it as phishing. The domain appears on one security blocklist, and its SSL certificate was issued by Let's Encrypt (R12). The combination of Google IP hosting and Gmail impersonation suggests an attempt to exploit perceived legitimacy through infrastructure association. While currently inactive, this domain represents a documented credential theft operation. Organizations should implement DNS-based blocking for llamasaswap.com and monitor for similar patterns, including domains registered through Dynadot with Let's Encrypt certificates resolving to cloud provider IPs. Users should verify domain authenticity before entering credentials, particularly when redirected from unexpected sources. Security teams are advised to review logs for connections to 142.250.185.228 between July 23 and the takedown date, as this may indicate compromised accounts requiring password resets.