xaman[.]build

Analysis as of July 24, 2026 indicates that the domain xaman.build was registered on March 06, 2026 through NiceNIC International Group Co., Limited and resolves to the Cloudflare IP 104.21.52.198, which is assigned to AS13335 in the United States. The domain is hosted on Cloudflare's network and uses the nameservers anastasia.ns.cloudflare.com and nash.ns.cloudflare.com. No SSL certificate was observed, and an HTTP request returns the generic page title “Just a moment…”, suggesting the site is either a placeholder or serving a redirect.

The domain has been classified as a brand‑impersonation campaign targeting the Xaman brand, and it was flagged by the security blocklist PhishDestroy. VirusTotal analysis shows that 1 of 94 scanned security vendors flagged the domain, and the domain appears on a single public blocklist. The site has been taken offline at the time of reporting.

Evidence confirms the infrastructure, registration details, and the single vendor detection, but the actual content of the site, any credential‑harvesting forms, or malicious payloads have not been captured, leaving the full operational intent uncertain. Defenders should continue to block the domain at network perimeter devices, update URL filtering and DNS sinkhole rules to include xaman.build, and monitor for any related domains using the same registrar or Cloudflare nameservers. Additional investigation should focus on capturing HTTP traffic if the site reappears, verifying whether the page serves malicious scripts, and correlating any observed phishing attempts against the Xaman brand with this indicator.