reward-xaman[.]app

This domain, reward-xaman.app, poses as the official Xaman wallet interface, presenting itself as a cold storage solution. Analysis indicates it is designed to deceive users into entering sensitive cryptocurrency wallet credentials or private keys, likely leading to unauthorized fund transfers or complete account compromise. The site employs social engineering tactics, leveraging the legitimate branding and terminology of Xaman to gain trust, while its infrastructure is configured to harvest and exfiltrate user input to attacker-controlled endpoints. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on June 10, 2024, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with fraudulent domains. It resolves to the IP address 188.114.97.3 and is currently flagged by 5 out of 95 security vendors on VirusTotal. Additionally, the domain appears on 4 distinct security blocklists and has been included in 4 AlienVault OTX threat intelligence pulses, further corroborating its malicious classification. The SSL certificate, issued by Google Trust Services, does not mitigate the risk, as phishing domains commonly use valid certificates to appear legitimate. Users who have visited reward-xaman.app or entered any information on the site should assume their credentials or private keys have been compromised. Immediately disconnect any connected wallets from the internet and transfer all assets to a new, secure wallet with a fresh seed phrase. Monitor all linked accounts for unauthorized transactions and revoke any suspicious wallet permissions or connected applications. Report the incident to relevant security teams and consider filing a report with local cybercrime authorities. Do not reuse passwords or seed phrases from the compromised wallet, as attackers may attempt to exploit them across other platforms.