xaman-rewards[.]com

PhishDestroy identifies xaman-rewards.com as an active fake rewards phishing domain posing under the guise of a cryptocurrency giveaway scheme. This domain was flagged by automated threat intelligence pipelines due to its suspicious registration details and operational infrastructure. The threat type is generic phishing, with an assigned risk level of under_investigation as analysts continue to evaluate its scope and additional infrastructure linked to this campaign. The site resolves to IP address 188.114.96.3 and was registered through NAMECHEAP INC on April 04, 2026. VirusTotal currently reports 2/95 detections and no active blocklist entries are recorded. The domain uses a valid SSL certificate issued by Let's Encrypt, which may enhance its perceived legitimacy among unsuspecting users.

This domain was registered very recently—April 04, 2026—and leverages a newly issued SSL certificate through a reputable provider to appear trustworthy. Despite zero detections on VirusTotal at this time, the absence of flagging does not equate to safety. The use of NAMECHEAP INC as the registrar and the specific IP allocation (188.114.96.3) are consistent with bulletproof hosting environments often associated with fraudulent reward schemes. The domain name itself mimics legitimate cryptocurrency reward platforms (e.g., Xaman), suggesting a deliberate impersonation strategy to deceive users.

To mitigate exposure to this threat, users should avoid visiting xaman-rewards.com and refrain from interacting with any pop-ups, ads, or emails referencing this domain. Report the domain to your email provider, security software vendor, and relevant threat intelligence platforms. Organisations should block the domain and IP (188.114.96.3) at the network perimeter. If funds or credentials were entered, immediately contact your financial institution and reset passwords across critical accounts. Always verify the authenticity of reward programs by visiting official websites directly via trusted bookmarks.