xamanrlusd[.]com

This domain, xamanrlusd.com, is identified as an active phishing site specifically targeting users of the Xaman cryptocurrency platform and RLUSD token allocations. Analysis confirms the threat type as a high-risk generic phishing operation, with the page title explicitly stating 'Xaman × RLUSD — Allocation Now Live,' indicating an attempt to deceive users into believing they are accessing a legitimate token allocation event. The domain remains active as of the latest verification. Infrastructure analysis reveals the domain was registered on May 25, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 104.21.8.12 and is protected by a Let's Encrypt SSL certificate. The domain is flagged by 13 of 95 security vendors on VirusTotal and appears on 5 distinct security blocklists. Additional technical indicators include the use of HSTS, Cloudflare, and HTTP/3, alongside detection by multiple cryptocurrency-specific security tools such as MetaMask, PhishDestroy, SEAL, ScamSniffer, and InversionDNS. The Gridinsoft trust score for this domain is 0/100, further confirming its malicious nature. The domain is currently active and poses a significant risk to users seeking Xaman or RLUSD-related services. Immediate action is recommended, including blocking the domain and its associated IP address at the network perimeter. Users should be advised to verify the authenticity of any token allocation events through official channels only. Security teams are urged to monitor for related indicators of compromise, including the domain, IP, and associated SSL certificate, to prevent further exploitation.