xaman-wallet-app[.]icu

The domain xaman-wallet-app.icu has been identified as a brand impersonation threat focused on imitating the crypto wallet brand Base. As of the latest investigation, this domain is currently offline. The purpose of this domain was to deceive users into believing it was a legitimate entity associated with Base, exploiting the trust in the brand to possibly harvest sensitive information or perform unauthorized transactions.

Evidence collected indicates that xaman-wallet-app.icu was flagged by 3 out of 95 security vendors on VirusTotal. The domain was created on April 13, 2026, and registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, suggesting a calculated and deliberate attempt to mislead users by establishing a seemingly legitimate presence. The domain resolved to the IP address 104.21.3.128 and used a Let's Encrypt SSL certificate, which is commonly utilized by legitimate and malicious sites alike due to the ease of obtaining such certificates. Additionally, it has appeared on one security blocklist, substantiating the potential risk it posed to users.

Currently, the domain's status is offline, mitigating immediate threats. However, due diligence is necessary given that similar domains may be activated in the future. It is recommended that users exercise caution when encountering domains that request sensitive information or claim affiliation with known brands without verification. Security teams should consider monitoring for newly registered domains with similar naming conventions, utilize blocklists, and apply strict email filtering rules to prevent potential phishing operations. Keeping software and threat detection systems updated with the latest intelligence feeds can further enhance protection against such threats.