xaman-site[.]icu

The domain xaman-site.icu is currently active and serves HTTP content with a 200 response code. The page title returned by the server is "Xaman Wallet — Desktop, Extension & Login | Monitoring Dashboard", indicating an attempt to collect credentials related to a wallet service. The site was first registered on April 11, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED.

Infrastructure analysis shows the domain resolves to the IP address 104.21.63.149, which is allocated to Cloudflare, Inc. in Canada. DNS resolution is handled by the authoritative nameservers eloise.ns.cloudflare.com and miles.ns.cloudflare.com. The TLS certificate is issued by Let’s Encrypt (E8), confirming that encrypted HTTPS is presented to visitors.

Threat intelligence classifies the activity as credential phishing. The site appears on one external blocklist and is specifically flagged by PhishDestroy. A Gridinsoft trust score of 0 out of 100 reinforces the malicious rating. VirusTotal reports that two out of ninety‑five security vendors have flagged the domain, providing additional corroboration of its malicious nature.

Defenders should treat traffic to xaman-site.icu as hostile. Immediate actions include adding the domain to network deny lists, updating web filtering rules, and monitoring DNS queries for the associated IP address. Because the hosting is behind Cloudflare, threat hunting should also consider potential use of the service for rapid re‑hosting, and any compromised credentials captured from the wallet login flow should be revoked and investigated.

While the current page title and infrastructure details are confirmed, the exact content served to victims has not been captured in this assessment. Consequently, the full scope of credential harvesting techniques and any additional malicious payloads remain uncertain. Ongoing analysis of HTTP traffic and periodic re‑scans are recommended to detect any evolution of the phishing campaign.