xamanwalletdesktop[.]at

This domain, xamanwalletdesktop.at, is identified as a crypto drainer. It was created on June 08, 2026, and does not appear to impersonate a specific brand. The domain has been associated with a crypto drainer kit, which is designed to siphon cryptocurrency from users' digital wallets by intercepting and redirecting login credentials or private keys.

Infrastructure analysis reveals that this domain has been flagged by 5 out of 95 security vendors on VirusTotal, indicating a moderate level of suspicion. The domain is registered with Let's Encrypt, a widely used SSL certificate authority, which provides a basic level of encryption but does not guarantee the legitimacy of the site. It resolves to the IP address 188.114.97.3 and has been found in 4 threat intelligence pulses on AlienVault OTX. The domain appears on 3 security blocklists and is currently listed as offline in the Google Safe Browsing (GSB) status.

The current status of xamanwalletdesktop.at is offline, which suggests that the domain has been taken down or is no longer active. Despite this, the domain remains a potential threat due to its prior association with malicious activities. Security measures such as blocking by MetaMask, PhishDestroy, and SEAL have been implemented to protect users. However, the elevated risk level and the presence of the domain on multiple blocklists indicate that vigilant monitoring and user education are still necessary to prevent any residual or future threats.