# xaman.build — SUSPICIOUS

> Check if xaman.build is safe to visit. This site impersonates Xaman but is offline now. Avoid sharing personal info and stay cautious online.

## Summary
PhishDestroy identifies xaman.build as a domain involved in brand impersonation targeting the company Xaman. Although currently taken offline, this domain posed a low-level risk by mimicking the legitimate brand to deceive visitors. Such sites can trick users into revealing sensitive data or credentials by appearing authentic.

This phishing attempt worked by registering a domain name similar to the brand Xaman and displaying a page titled "Just a moment...", likely to delay or confuse users while attempting to collect information or lead to malicious content. Despite only one security vendor flagging it and presence on a single blocklist, the domain’s association with brand impersonation warrants caution.

If you have visited xaman.build, it is recommended to avoid entering any personal or login information. Monitor your accounts for suspicious activity, especially those linked to Xaman services. Since the domain is offline, no immediate threat exists, but users should remain vigilant and report any suspicious emails or messages referencing this domain to their security teams.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: dead (HTTP 0)
- Target brand: Xaman
- Page title: Just a moment...

## Domain Intelligence
- Registered: 2026-03-06 15:07:01
- Registrar: NiceNIC International Group Co., Limited
- Country: HK
- IP: 104.21.52.198
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: anastasia.ns.cloudflare.com nash.ns.cloudflare.com
- SSL Issuer: none

## Detection Status
- VirusTotal: 1 vendors flagged
  Vendors: ["Fortinet"]
- Google Safe Browsing: clean
- Blocklists: 1 hits
  Lists: ["PhishDestroy"]

## Evidence
- Screenshot: https://i.ibb.co/mFNpbRYj/cdff7b09bf8f.png
- Cloudflare Radar: https://radar.cloudflare.com/domains/xaman.build
- Wayback Machine: https://web.archive.org/web/https://xaman.build
- PhishDestroy: https://phishdestroy.io/domain/xaman.build/
- LLM endpoint: https://phishdestroy.io/domain/xaman.build/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/xaman.build/
Last updated: 2026-03-19