xamanext[.]co[.]com

Analysis indicates that the domain xamanext.co.com is actively engaged in credential phishing targeting users of the Xaman Wallet, a cryptocurrency wallet service. The domain was registered on May 1, 2026, through Moniker Online Services LLC and currently resolves to the IP address 104.21.60.155, which is geolocated in Canada and associated with Cloudflare, Inc. The domain's nameservers are ns1.nic.co.com, ns2.nic.co.com, ns3.nic.co.com, and ns4.nic.co.com, a configuration consistent with infrastructure used for large-scale phishing operations. The page title, 'Xaman Wallet — Desktop, Extension & Login | Certification,' explicitly references the Xaman Wallet brand, suggesting an intent to deceive users into believing the site is an official portal for wallet access or certification. The domain has been classified as a credential phishing threat by multiple security vendors, including PhishDestroy, MetaMask, and SEAL, and appears on three security blocklists. A Gridinsoft trust score of 0/100 further corroborates its malicious classification. One of 91 security vendors on VirusTotal has flagged the domain, though this single detection does not provide conclusive evidence of widespread recognition. Infrastructure analysis reveals the use of Cloudflare services, including HTTP/3 and HSTS, which are often employed to obfuscate the true origin of phishing sites and enhance perceived legitimacy. The domain remains active as of July 12, 2026, with an HTTP status of 200, indicating the phishing page is accessible. No evidence of a phishing kit or additional technical artifacts has been confirmed at this time. Defenders are advised to block the domain at the DNS or network level and monitor for related infrastructure, particularly domains registered through the same registrar or utilizing identical nameserver patterns. Users should be alerted to the existence of this phishing campaign, particularly those associated with the targeted brand.