xanam[.]app

The domain xanam.app was a generic phishing site posing no direct impersonation of a known brand or use of a drainer kit. It operated as a credential-harvesting page targeting visitors with a login or payment form, classified as elevated risk due to its phishing activity. As of the latest verification, xanam.app has been taken offline, though prior detections confirm its malicious intent.

Technical indicators for xanam.app include 3 of 95 VirusTotal security vendors flagging the domain, including Fortinet, Gridinsoft, and SOCRadar. The domain was registered through NiceNIC International Group Co., Limited on February 21, 2026, and resolved to the IP address 104.21.68.155, hosted on Cloudflare's network (AS13335) in the US. It appeared on one security blocklist (PhishDestroy) and used an SSL certificate issued by Google Trust Services (WE1). The observed page title was 'Ayahuasca — Xamán Café', and technologies detected included Stimulus, Cloudflare, and HTTP/3. Gridinsoft assigned a trust score of 0/100, reinforcing its malicious classification.

Individuals who interacted with xanam.app should immediately change any credentials entered on the site, particularly if reused across other platforms. Enable multi-factor authentication (2FA) on all sensitive accounts to mitigate further risk. Monitor financial statements and account activity for signs of fraud or unauthorized access. Report the domain to relevant authorities, such as local cybercrime units or platforms like Google Safe Browsing, to aid in broader takedown efforts. If the site was accessed via a phishing link, scan the device for malware to ensure no additional compromise occurred.