xamanwalletextension[.]at

xamanwalletextension.at is currently active and poses a significant threat to cryptocurrency users. Detected on June 9, 2026, it has already been flagged by 4 out of 91 vendors on VirusTotal. This indicates a growing awareness of the threat, yet it remains operational. The domain is listed on three public blocklists, including PhishDestroy, MetaMask, and SEAL, highlighting its malicious nature.

The domain's page title, "Welcome," suggests a generic landing page, potentially designed to mimic legitimate cryptocurrency wallet extensions. Such tactics aim to deceive users into entering sensitive information, which can then be exploited by attackers. The site is hosted on IP address 188.114.96.3, with an SSL certificate issued by Let's Encrypt, a common choice for both legitimate and malicious sites due to its ease of access and cost-free nature.

With a platform risk score of 83 out of 100, xamanwalletextension.at is considered highly risky. The domain's presence on multiple blocklists and its detection by several security vendors underscore the need for prompt action to mitigate its impact. As phishing domains often exploit the time lag between their registration and detection by antivirus databases, early identification by PhishDestroy plays a crucial role in protecting users from potential scams.