xamantoken[.]my

Analysis of the domain xamantoken.my indicates active brand impersonation targeting users of the Xaman cryptocurrency wallet. The domain, registered on May 5, 2026, through Global Domain Group LLC, resolves to IP 172.67.201.254, hosted on Cloudflare infrastructure in Canada, with nameservers ben.ns.cloudflare.com and fatima.ns.cloudflare.com. The page title, 'Cold Storage in Your Pocket | Xaman,' directly references the legitimate Xaman wallet service, confirming the intent to deceive users into believing the site is affiliated with the official platform. The domain is flagged by three security blocklists and blocked by PhishDestroy, MetaMask, and SEAL, reflecting high confidence in its malicious classification.

AlienVault OTX lists it in one threat intelligence pulse, while Gridinsoft assigns a trust score of 0/100. A single security vendor on VirusTotal flags the domain, though the limited detection count does not diminish the broader consensus from blocklists and threat intelligence platforms. The SSL certificate is issued by Let's Encrypt (serial E7), and the site returns an HTTP 200 status, indicating it is actively serving content. Defenders should treat this domain as a high-risk phishing site impersonating Xaman.

The use of Cloudflare hosting and a recent registration date aligns with common tactics to evade detection and maintain operational security. No evidence of a specific phishing kit or payload is currently available, but the domain's active status and confirmed blocklist presence warrant immediate blocking at the DNS or proxy level. Further investigation into associated infrastructure, such as the resolved IP and nameservers, may reveal additional linked malicious domains.