wallet-xaman[.]app

Analysis indicates that wallet-xaman.app was registered on 14 September 2025 through NICENIC INTERNATIONAL GROUP CO., LIMITED and delegated to Cloudflare nameservers anuj.ns.cloudflare.com and blakely.ns.cloudflare.com. The domain resolves to 104.21.37.152, an address owned by Cloudflare (AS13335) located in the United States. No TLS certificate was observed, and the site was taken offline at the time of review. The sole visible page title reads "The Best Wallet for Security & Control," which aligns with the listed scam type of wallet/seed phishing and the broader brand-impersonation indicator.

VirusTotal scans show that ten out of ninety-five security vendors flagged the domain, suggesting the presence of malicious characteristics. The domain appears on two public blocklists, PhishDestroy and ScamSniffer, further corroborating its malicious reputation. Gridinsoft assigned a trust score of 0 out of 100, indicating a complete lack of trust. Because the site is currently offline, real-time content cannot be inspected, and the exact phishing payload or credential-capture mechanisms remain unknown.

Defenders should block any outbound connections to 104.21.37.152 and add wallet-xaman.app to local deny lists. Network monitoring should watch for DNS queries to the domain or its Cloudflare nameservers, and email filters should flag messages containing URLs that resolve to the same IP range. Incident response teams should treat any credentials or seed phrases reported as possibly compromised, advise users to rotate wallet keys, and consider the domain a confirmed malicious actor pending further forensic collection.