xamanwalletdesktop[.]co[.]com

This domain, xamanwalletdesktop.co.com, is flagged as a high-risk crypto drainer operation. Analysis indicates it remains active as of July 12, 2026, resolving to IP 188.114.96.3, hosted on Cloudflare infrastructure in Canada. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, suggesting targeted detection by cryptocurrency security tools. Its SSL certificate is issued by Let's Encrypt (serial E7), and the page title 'Welcome' provides no explicit brand confirmation, though the domain structure implies impersonation of a wallet service. Infrastructure analysis reveals the use of Cloudflare Browser Insights and HTTP/3, typical of modern phishing sites aiming to evade detection. The domain is registered through Moniker Online Services LLC, with nameservers under nic.co.com. While only 2 of 91 security vendors flagged this domain on VirusTotal, the low detection rate does not indicate safety, particularly given its presence on specialized blocklists. The exact content of the site has not been analyzed, but the domain's classification as a crypto drainer aligns with its inclusion on cryptocurrency-focused threat feeds. Defenders should treat this domain as active and malicious. Recommended actions include blocking resolution at the DNS level, monitoring for connections to the IP 188.114.96.3, and alerting users to potential wallet-draining attempts. Further investigation into associated wallet addresses or transaction patterns is advised if this domain is encountered in incident response.