xaman[.]fund

This domain, xaman.fund, is actively engaged in cryptocurrency theft by impersonating the legitimate Xaman Wallet interface. Analysis indicates the site employs a crypto drainer mechanism, designed to automatically siphon digital assets from connected wallets upon user interaction. The threat specifically targets users who may be tricked into linking their wallets to the malicious domain, resulting in irreversible fund loss without further user confirmation. Infrastructure analysis reveals the following technical indicators: the domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, an uncommon registrar for legitimate financial services. It resolves to the IP address 188.114.96.3 and is secured with a Let's Encrypt SSL certificate, a common tactic to appear legitimate. Detection metrics show minimal coverage, with only 1 of 95 security vendors on VirusTotal flagging the domain. Additionally, the domain appears on one security blocklist and has been documented in a single AlienVault OTX threat intelligence pulse. Users who have visited xaman.fund or connected a wallet to the site should immediately revoke any active wallet sessions and transfer remaining assets to a new, secure wallet address. It is critical to monitor transaction history for unauthorized transfers and report any suspicious activity to relevant blockchain explorers or security platforms. No further interaction with the domain should occur, and users are advised to verify the authenticity of wallet interfaces through official sources before entering sensitive information or connecting wallets.