rewards-xaman[.]icu

PhishDestroy identifies rewards-xaman.icu as an active crypto drainer phishing domain designed to steal cryptocurrency from Xaman wallet users. The domain poses as a legitimate rewards platform to trick victims into connecting their wallets and authorizing malicious transactions. This campaign is currently under investigation but remains highly dangerous due to its active status and lack of detection by security engines. Users should treat this domain as hostile and avoid all interactions. This domain was flagged on June 21, 2026, with a VirusTotal detection rate of 3 out of 95 engines, indicating zero current signature-based detection despite its malicious nature. It resolves to IP 104.21.93.204 and uses Cloudflare nameservers (kehlani.ns.cloudflare.com, mark.ns.cloudflare.com). The domain is registered through NameSilo, LLC, a registrar known for accommodating high-risk domains, and remains unlisted on all major blocklists and threat intelligence feeds as of the latest scan. The domain's recent creation and clean reputation score suggest it was deployed specifically to evade detection during an active phishing campaign targeting Xaman wallet users. The primary risk stems from the domain's active crypto drainer functionality, which likely involves tricking victims into signing malicious transactions that drain wallet funds. Given the zero detection rate and lack of historical data, the threat is considered emergent and requires immediate attention. Users should verify the legitimacy of any Xaman wallet-related domain on PhishDestroy before entering credentials or connecting wallets. Block the domain at the network level and report any interactions to PhishDestroy for further analysis. Additionally, users who have already interacted with this domain should revoke any unauthorized wallet connections immediately and transfer remaining funds to a secure wallet.