xaman-tech[.]icu

PhishDestroy classifies the domain xaman-tech.icu under an under investigation risk level due to its suspected involvement in a credential theft scam masquerading as the Xaman Wallet platform. This threat specifically aims to harvest user login credentials through deceitful desktop and browser extension interfaces, representing a severe risk to account security and user privacy.

The domain was registered recently on April 6, 2026, and remains active with a Let's Encrypt SSL certificate in place. Despite zero detections in VirusTotal across 95 engines, this domain resolves to IP address 188.114.97.3 and is registered via NICENIC INTERNATIONAL GROUP CO., LIMITED. The page title detected is "Xaman Wallet — Desktop, Extension & Login | Glossary," which attempts to lend a legitimate appearance to the fraudulent site. No current blocklist listings have been reported; however, the domain's recent creation and generic SSL certificate paired with active phishing indicators warrant close scrutiny.

To mitigate risks associated with credential theft scams like those posed by xaman-tech.icu, users should avoid entering login details on unverified platforms. Organizations must employ domain and IP monitoring tools to detect spoofed wallet interfaces and educate users on recognizing fraudulent sites. Implementing multi-factor authentication (MFA) on Xaman Wallet accounts will add a critical layer of defense. Immediate blacklisting of the domain on firewalls and email filters is recommended to prevent phishing link distribution until further investigation confirms its status.