xamans[.]live

xamans.live is currently active and employs cloaking techniques to evade detection. Despite its low cloaking score of 1/10, it effectively serves benign content to scanners while potentially delivering malicious payloads to unsuspecting users. This domain is flagged as malicious by 4 out of 91 vendors on VirusTotal, indicating a level of awareness among some security vendors.

The domain is registered with NICENIC INTERNATIONAL GROUP CO., LIMITED and is hosted on IP address 188.114.96.3. It uses an SSL certificate issued by Let's Encrypt, which is common among phishing sites due to its ease of access and free service. The presence of this domain on public blocklists such as PhishDestroy, MetaMask, and SEAL further underscores its malicious intent.

Phishing domains like xamans.live exploit the gap between their registration and the time it takes for security databases to update. PhishDestroy's pipeline captures threats in this critical pre-detection window, allowing for early identification and mitigation. The combination of cloaking tactics and selective content delivery makes this domain a sophisticated threat that requires ongoing monitoring.