xaman-app[.]icu

The domain xaman-app.icu was designed to impersonate the legitimate Xaman Wallet platform, tricking users into believing they were accessing a genuine desktop extension or login page. In reality, this site was a sophisticated crypto drainer, meaning any private keys, seed phrases, or credentials entered would be stolen, leading to immediate theft of cryptocurrency assets. The page title explicitly referenced 'Xaman Wallet Research' to appear legitimate, but its sole purpose was credential harvesting.

PhishDestroy identified this threat through multiple technical indicators. VirusTotal data shows that 3 out of 95 security vendors flagged the domain as malicious, and it appears on at least one security blocklist. The domain was registered on April 11, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and was hosted on IP address 188.114.97.3 with an SSL certificate from Let's Encrypt. These factors, combined with the domain's recent creation and suspicious naming pattern, confirm it was a phishing operation designed to steal cryptocurrency.

If you visited xaman-app.icu and entered any sensitive information, immediately transfer your crypto assets to a new wallet that was never exposed to this site. Change all associated passwords and enable two-factor authentication where possible. Run a security scan on your device and monitor your accounts for unauthorized activity. Report the incident to relevant crypto platforms and consider freezing any affected accounts. Remember, always verify URLs carefully before entering credentials, and only use official app stores or verified websites for wallet access.