emdash-feat-fusion-integrati[.]llamaswap-5ip[.]pages[.]dev

PhishDestroy identifies emdash-feat-fusion-integrati.llamaswap-5ip.pages.dev as an active crypto drainer domain engaged in brand impersonation targeting Llamaswap users. The domain remains under investigation with a current status classified as active, indicating ongoing malicious campaigns. This domain was flagged by 1 of 95 VirusTotal vendors, suggesting it has evaded detection despite its malicious nature. Registered through Cloudflare, Inc., the domain resolves to IP 188.114.97.3 and operates under a Google Trust Services SSL certificate. While the exact creation date is not disclosed, the lack of detections and low trust indicators warrant immediate scrutiny. The domain mimics Llamaswap, a known DeFi platform, to deceive users into connecting crypto wallets and draining funds. Given the absence of VirusTotal detections and the domain's active status, organizations and individuals must treat this as a high-risk threat. Users should avoid interacting with emdash-feat-fusion-integrati.llamaswap-5ip.pages.dev and block the associated IP 188.114.97.3 at the network perimeter. Immediate reporting of this domain to threat intelligence platforms and internal SOC teams is recommended to prevent potential financial losses. Proactive monitoring of crypto-related domains and user awareness campaigns are critical to mitigating this impersonation threat.