get-xaman[.]app

The domain get-xaman.app was registered on July 15, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is currently active. DNS resolution points to the IP address 188.114.97.3 and the authoritative nameservers are dax.ns.cloudflare.com and virginia.ns.cloudflare.com, indicating use of Cloudflare infrastructure. The only visible page element is a title tag reading "Just a moment...," which provides no additional context about the intended victim or impersonated brand. VirusTotal analysis shows that 3 of 91 security vendors have flagged the domain, confirming that at least a subset of scanners consider it malicious.

Independent blocklists have added the domain to three separate deny lists, and it is explicitly blocked by PhishDestroy, MetaMask, and SEAL, reinforcing the consensus that the site is being used for phishing or related abuse. The high risk rating reflects the combination of recent creation, active hosting, and multiple detections. At present, no further technical artifacts such as SSL certificate details, HTTP response codes, or content hashes have been disclosed, leaving the exact payload or credential‑harvesting mechanism uncertain.

Defenders should immediately block DNS resolution to 188.114.97.3 and enforce URL filtering for get-xaman.app across perimeter and endpoint controls. Continuous monitoring of Cloudflare name server changes and periodic re‑scans on VirusTotal are recommended to capture any evolution of the threat. Organizations should also advise users to avoid any unsolicited links that resolve to this domain, especially those that present a generic landing page with the title "Just a moment..." which may be used to disguise malicious redirects.