xaman-app[.]online

The domain xaman-app.online has been identified as a credential phishing resource specifically designed to impersonate cryptocurrency wallet services. Analysis indicates this domain was actively targeting users of the Xaman wallet, a legitimate cryptocurrency management platform, by presenting a fraudulent interface labeled 'Hostinger Game Panel.' The domain is currently offline, though prior activity suggests it was operational for a limited period to harvest sensitive authentication credentials. Infrastructure analysis reveals the domain was registered on September 28, 2025, through GoDaddy.com, LLC, and resolved to the IP address 104.21.80.15. At the time of detection, the domain was flagged by 5 of 95 security vendors on VirusTotal, while Gridinsoft assigned it a trust score of 0 out of 100. The domain appears on three security blocklists and has been referenced in two threat intelligence pulses on AlienVault OTX. Detected technologies include Nginx as the web server, alongside jQuery, Glyphicons, and Gravatar, which may have been employed to enhance the legitimacy of the phishing interface. The SSL certificate was issued by Google Trust Services, a common tactic to evade initial suspicion. Current assessment classifies this as an elevated-risk threat due to its targeted nature and the potential impact of credential compromise in cryptocurrency transactions. While the domain is no longer accessible, users who interacted with it should immediately revoke any exposed credentials and monitor associated accounts for unauthorized activity. Organizations are advised to update blocklists with the domain and IP address, and to educate users on recognizing phishing attempts that leverage impersonation of cryptocurrency services. Further monitoring of newly registered domains with similar naming patterns is recommended to preemptively mitigate related threats.