# xaman-crypto.icu — SUSPICIOUS

> PhishDestroy identifies xaman-crypto.icu as a live crypto drainer impersonating Xaman Wallet. VirusTotal shows 0/95 detections.

## Summary
PhishDestroy identifies xaman-crypto.icu as a crypto-draining phishing site actively mimicking the Xaman Wallet brand to trick users into connecting their wallets and draining funds. The page likely hosts a drainer kit designed to siphon cryptocurrency via malicious wallet-connect prompts and signature interception once victims authorize transactions.    Technical indicators for this domain include a VirusTotal detection ratio of 0/95, registration through NICENIC INTERNATIONAL GROUP CO., LIMITED, a resolved IP of 172.67.165.14, a creation date of April 06, 2026, and an SSL certificate issued by Let’s Encrypt. Google Safe Browsing status is currently unflagged and no third-party blocklists have yet flagged this domain.    The site remains active at the time of writing and poses an elevated risk due to its drainer functionality and wallet-brand impersonation. Users and organizations are advised to block 172.67.165.14 and the domain xaman-crypto.icu at the network perimeter, warn wallet users, and report indicators to threat-intel platforms. Remaining risk is moderate pending takedown and continued monitoring.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2026-04-06 21:37:15
- Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED
- IP: 172.67.165.14

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/1476155e-84a5-4ff5-877a-6c4fa749a7e1
- PhishDestroy: https://phishdestroy.io/domain/xaman-crypto.icu/
- LLM endpoint: https://phishdestroy.io/domain/xaman-crypto.icu/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/xaman-crypto.icu/
Last updated: 2026-04-11