voter-xaman[.]app

The domain voter-xaman.app has been identified as a brand impersonation threat specifically targeting Xaman, a recognized entity in the digital asset ecosystem. Analysis confirms the domain is designed to deceive users by mimicking legitimate Xaman services, aligning with observed patterns of credential harvesting and fraudulent transaction facilitation. As of the latest assessment, the domain has been taken offline, though prior activity remains under investigation for potential residual impact. Infrastructure analysis reveals the domain was registered on March 03, 2026, through NiceNIC International Group Co., Limited, a registrar historically associated with high-risk registrations. The domain resolves to the IP address 104.21.84.128, which has been previously linked to multiple suspicious domains. Security vendor engagement shows limited but concerning detection, with 2 of 95 vendors on VirusTotal flagging the domain as malicious. The domain appears on one security blocklist, and Gridinsoft assigned a trust score of 0/100, indicating negligible legitimacy. The observed page title, 'Nur einen Moment…,' suggests an attempt to mimic loading or authentication pages, a common tactic in phishing campaigns to delay user suspicion. Current status indicates the domain is offline, reducing immediate risk of active exploitation. However, historical resolution and registration details warrant continued monitoring. Organizations and users are advised to implement domain-based blocking for voter-xaman.app and its associated IP, 104.21.84.128, within network security controls. Security teams should review logs for prior connections to this domain or IP to identify potential compromise. Given the elevated risk level, proactive measures such as user education on brand impersonation tactics and multi-factor authentication enforcement are recommended to mitigate future threats from similar infrastructure.