xaman-elh[.]pages[.]dev

xaman-elh.pages.dev is assessed as a high-risk domain engaging in brand impersonation. The threat type is specifically a fake login page designed to mimic the legitimate site of argent, a well-known cryptocurrency wallet provider. This impersonation aims to deceive users into divulging sensitive information, such as login credentials, which can be used for unauthorized access or further malicious activities.

Infrastructure analysis reveals that xaman-elh.pages.dev is registered through Cloudflare, Inc., and resolves to the IP address 188.114.97.3, which is located in the United States and part of the AS13335 Cloudflare, Inc. network. The domain was created on August 06, 2025, and is currently still active. The page title 'Xaman. Your XRP. Your wallet.' further supports the impersonation of argent. Notably, VirusTotal flags this domain with a detection rate of 1/95, indicating a low but significant level of suspicion among security vendors. Additionally, the domain appears on one security blocklist, specifically PhishDestroy, which is known for identifying and blocking phishing and brand impersonation activities. The SSL certificate is issued by Google Trust Services / WE1, which can sometimes lend a false sense of security to unsuspecting users.

To mitigate the risks associated with this brand impersonation threat, users are advised to verify the URL of any website they visit, especially when logging into cryptocurrency wallets or financial services. They should ensure that the domain matches the official website of argent and look for the correct SSL certificate. Security teams should consider blocking access to xaman-elh.pages.dev at the network level and educate users about the dangers of visiting unverified links. Furthermore, monitoring for similar domain registrations and IP addresses can help in identifying and mitigating related threats.