xaman[.]to

This domain, xaman.to, is actively targeting users of the Xaman cryptocurrency wallet through phishing tactics. Visitors are presented with a deceptive interface designed to harvest wallet credentials, seed phrases, or private keys, enabling attackers to drain funds from compromised accounts. The site mimics legitimate wallet login pages, often using social engineering to trick users into entering sensitive information under false pretenses, such as account verification or security updates. Analysis indicates the domain was registered on March 11, 2026, through the Government of the Kingdom of Tonga, an uncommon registrar for such threats. It resolves to the IP address 104.21.92.37 and uses a Let's Encrypt SSL certificate (E7), which does not guarantee legitimacy. VirusTotal reports that 5 out of 95 security vendors have flagged this domain as malicious, and it appears on 3 distinct security blocklists. The page title, 'Welcome,' is generic and lacks the branding expected from the authentic Xaman wallet, further suggesting malicious intent. If you visited xaman.to or entered any information on the site, immediately disconnect the device from the internet to prevent further data exfiltration. Revoke any active wallet sessions and transfer remaining funds to a new, secure wallet using a different device. Reset all passwords and seed phrases associated with the compromised wallet, and monitor connected accounts for unauthorized transactions. Report the incident to relevant security teams or blockchain analytics platforms to assist in tracking the threat. Avoid interacting with the domain or any links associated with it, and verify the authenticity of wallet-related communications through official channels only.