xamanxumm[.]app

PhishDestroy has identified xamanxumm.app as a generic phishing domain with an elevated risk level, and it is currently offline. This domain was designed to mimic legitimate platforms to steal sensitive information from unsuspecting users. The elevated risk level indicates that while the domain is no longer active, it poses a significant threat to anyone who may have interacted with it while it was operational.

PhishDestroy's analysis reveals that xamanxumm.app was flagged by 7 out of 95 security vendors on VirusTotal, and it appears on one security blocklist. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and created on March 26, 2026, which is unusually recent and indicative of malicious intent. It resolves to IP address 104.21.25.97 and uses an SSL certificate from Google Trust Services (WE1). Additionally, AlienVault OTX found this domain in one threat intelligence pulse, corroborating its malicious nature. The page title was "Just a moment..." which is a common technique used by phishing sites to evade detection.

Users who may have visited xamanxumm.app should change their passwords immediately and enable two-factor authentication on any accounts that may have been compromised. It is also recommended to run a full system scan with updated antivirus software and monitor financial accounts for unauthorized activity. PhishDestroy advises blocking this domain at the network level and reporting it to relevant authorities to prevent future victims.