xamansetup[.]app

The domain xamansetup.app was identified as a phishing site involved in brand impersonation targeting Xaman. This domain was designed to mimic Xaman, as indicated by its page title 'Xaman | Secure your crypto with confidence', intending to deceive users into believing it was an official resource. The site has since been taken offline, but during its operation, it posed an elevated risk for potential victims searching for legitimate Xaman services.

Technical analysis shows that xamansetup.app was registered through NiceNIC International Group Co., Limited on February 21, 2026. The domain resolved to IP address 216.198.79.1, located in the US under AS16509 (Amazon.com, Inc.), and used SSL certificates issued by Let's Encrypt / R13. Detection rates include 2 of 95 security vendors on VirusTotal (specifically Fortinet and SOCRadar) flagging the domain as malicious. It appears on one security blocklist, PhishDestroy, and has a Gridinsoft trust score of 0/100. Technologies detected include Vercel and HSTS, and the domain used Cloudflare nameservers 'michael.ns.cloudflare.com' and 'sandra.ns.cloudflare.com'.

Anyone who interacted with xamansetup.app should immediately change any passwords used on the site, enable two-factor authentication, and monitor related accounts for suspicious activity. Since the scam type was brand impersonation without a crypto drainer kit, users should remain alert for potential credential compromise or follow-up phishing attempts. Incidents involving phishing or impersonation can be reported to relevant authorities and to the impersonated brand, Xaman, to help prevent further abuse.