gover-xaman[.]app

This domain, gover-xaman.app, is flagged as a generic phishing threat and remains active as of the latest analysis. The domain does not impersonate a specific brand but exhibits characteristics consistent with credential harvesting or deceptive data collection campaigns. Its high-risk classification is based on multiple technical indicators and limited but consistent detection across security platforms.

Technical analysis reveals that gover-xaman.app is flagged by 3 of 95 VirusTotal vendors, indicating partial but credible recognition among security engines. The domain resolves to IP address 172.67.165.32, which is associated with Cloudflare infrastructure. The SSL certificate is issued by Google Trust Services, a legitimate certificate authority, which may be used to lend false credibility to the phishing page. The domain was created on June 19, 2026, through registrar NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar sometimes associated with lower scrutiny registration practices. No blocklist count or trust score is provided in the available intelligence, but the detection ratio and registration details contribute to the high-risk assessment.

The domain is currently active and accessible, posing an ongoing threat to users who may encounter it via email, social engineering, or malvertising. Recommended actions include blocking the domain at the network level, adding it to email security filters, and monitoring for related subdomains or IP addresses. Users who have visited the site should change passwords and enable multi-factor authentication on potentially exposed accounts. Organizations should review access logs for connections to 172.67.165.32 and update threat intelligence feeds accordingly.