# PhishDestroy domain threat record: claim-xaman.app Content language: English Canonical HTML report: https://phishdestroy.io/domain/claim-xaman.app/ Machine-readable companion: https://phishdestroy.io/domain/claim-xaman.app/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-27 16:34:23 UTC - Last availability or vendor check: 2026-10-28 00:30:46 UTC - Stored record updated: 2026-10-28 01:00:09 UTC - VirusTotal detections in the stored snapshot: 1/92 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: flagged ## Stored classification - Targeted brand: Xaman ## Stored infrastructure - Observed IP address: 172.67.201.159 - Registrar in stored WHOIS data: Dynadot LLC. - Last stored HTTP status: 200 ## Evidence links - URLScan report: https://urlscan.io/result/01a17e3c-a27d-71fe-ab82-8733d54cb9b8/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/claim-xaman.app - Certificate Transparency search: https://crt.sh/?q=%25.claim-xaman.app - Web Archive lookup: https://web.archive.org/web/*/https://claim-xaman.app/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored page captures - Primary capture: https://i.ibb.co/4wz9Fw80/d51b41c286ae.png Captured: 2026-10-27 16:42:08 UTC - URLScan capture 1: https://urlscan.io/screenshots/01a17e3c-a27d-71fe-ab82-8733d54cb9b8.png Captured: 2026-10-27 16:42:08 UTC Source report: https://urlscan.io/result/01a17e3c-a27d-71fe-ab82-8733d54cb9b8/ - URLScan capture 2: https://screenshots.phishdestroy.io/01a17cbe-58c0-7465-bf32-706ba35cba30.png Captured: 2026-10-27 16:34:23 UTC Source report: https://urlscan.io/result/01a17e3c-a27d-71fe-ab82-8733d54cb9b8/ - URLScan · 2026-10-27: https://screenshots.phishdestroy.io/us/01a17b33-71bb-71c8-9caf-e965ba84d591.png Captured: 2026-10-27 02:32:20 UTC Source report: https://urlscan.io/result/01a17b33-71bb-71c8-9caf-e965ba84d591/ SHA-256: 17e3300bcaaff3256b24c077e8bafda95132eca4ffebefb5d789483a87abc71f - URLScan · 2026-10-27: https://screenshots.phishdestroy.io/us/01a17b33-7255-76e0-b0d8-bea4176b3c6d.png Captured: 2026-10-27 02:32:20 UTC Source report: https://urlscan.io/result/01a17b33-7255-76e0-b0d8-bea4176b3c6d/ SHA-256: 4274bfd83527642e4828f56f76fad7a42f63719b9acd3f7d1836738af80ea0b6 - URLScan · 2026-10-27: https://screenshots.phishdestroy.io/us/01a17e36-a66e-748d-95e6-0ad1a9cbbc71.png Captured: 2026-10-27 16:34:48 UTC Source report: https://urlscan.io/result/01a17e36-a66e-748d-95e6-0ad1a9cbbc71/ SHA-256: 1fc0445af5951ffcb56f9b7d6bb37f0cc47edb9abede10512629bf79002b691d - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/7d4b93a9-9898-47bd-90c3-a33e32e801f8.png Captured: 2026-10-27 16:36:24 UTC Source report: https://radar.cloudflare.com/scan/7d4b93a9-9898-47bd-90c3-a33e32e801f8 SHA-256: 1c3ba80d126b467591eb5c65bf125fc14e62c1f5b7d47073ad5a478ffc005dfa - URLScan · 2026-10-27: https://screenshots.phishdestroy.io/us/01a17cbe-58c0-7465-bf32-706ba35cba30.png Captured: 2026-10-27 09:43:39 UTC Source report: https://urlscan.io/result/01a17cbe-58c0-7465-bf32-706ba35cba30/ SHA-256: a31fb36a643ec2c2ed31f91f10e46a6c81c272c767274c15be16b79faa00f654 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-27T17:08:54Z", "uuid": "01a17e3c-a27d-71fe-ab82-8733d54cb9b8", "scanned_at": "2026-10-27T16:41:16Z", "final_url": "https://claim-xaman.app/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://claim-xaman.app/", "from": "http://claim-xaman.app/", "status": 307 } ], "ip": "172.67.201.159", "domains": [ "xrpl-scaner.com", "crossmark.io", "play-lh.googleusercontent.com", "pbs.twimg.com", "api.ipify.org" ], "ips": [ "172.67.162.171", "76.76.21.21", "142.251.127.119", "146.75.116.159", "104.26.13.205", "172.67.201.159" ], "asns": [ "13335", "16509", "15169", "54113" ], "countries": [ "US", "DE" ], "link_domains": [ "xaman.app", "help.xaman.app", "play.google.com", "apps.apple.com", "webflow-proxy-cdn.xaman.app", "xrpl-labs.com", "github.com", "xumm.app", "x.com", "www.youtube.com", "www.linkedin.com" ], "social": [ "https://github.com/XRPL-Labs/Xaman-Issue-Tracker/blob/master/RESPONSIBLE-DISCLOSURE.md", "https://x.com/xrpllabs", "https://x.com/XamanWallet", "https://x.com/xamanwallet", "https://www.youtube.com/@XamanApp" ], "doc_hash": "68612cc9f0afb35c354196d4f2eff443848828a5829a1b51e473e39a66ca0fbe", "script_hashes": [ "696c135f7ad08d2714a53e8e68b37b17554185780741fb7c0896ad94601b1e15", "cc64b8100b163485bfb151a8f4f039da0bf9d22684746c0b862355ab6d91d4fd" ], "globals": [ "_0x2ef6", "_0xcbc15", "_0x16b7", "__ledgerLogsListen", "XRPLWalletConnect", "__xamanSeedP" ], "tls": { "san": [ "*.claim-xaman.app", "claim-xaman.app" ], "cipher": "AES_128_GCM", "issuer": "YE2", "subject": "claim-xaman.app", "protocol": "QUIC", "valid_to": "2027-01-25T01:28:05Z", "valid_from": "2026-10-27T01:28:06Z" }, "domain_age_days": 0, "apex_age_days": 0, "tls_age_days": 0, "tls_valid_days": 89, "requests": 29, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 98, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "genericcrypto" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Generic Crypto" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "server": "cloudflare", "content-type": "text/html", "strict-transport-security": "max-age=63072000; includeSubDomains; preload", "content-security-policy": "frame-ancestors http: https:", "x-content-type-options": "nosniff" } }, "cf": { "v": 1, "fetched_at": "2026-10-27T16:39:14Z", "uuid": "7d4b93a9-9898-47bd-90c3-a33e32e801f8", "scanned_at": "2026-10-27T16:36:24Z", "final_url": "https://claim-xaman.app/", "status": 200, "history": [ { "url": "https://claim-xaman.app/", "status": 200 } ], "dom_hash": "4ee2876451da4f073a88df7278aab8a05b42bdcb796f085562428e845b593eb1", "doc_hash": "7c39a1e0bfc7c1a0ed77435c916898df602a5d3fb29d11ebf0dccb00e51dce64", "phishing_v2": [ "phishing" ], "domain_risks": [ "Newly Seen Domains", "Security Risks" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "claim-xaman.app", "type": "A", "value": "172.67.201.159" }, { "name": "claim-xaman.app", "type": "A", "value": "104.21.36.252" }, { "name": "claim-xaman.app", "type": "AAAA", "value": "2606:4700:3031::ac43:c99f" }, { "name": "claim-xaman.app", "type": "AAAA", "value": "2606:4700:3034::6815:24fc" } ], "dnssec_valid": false, "ip": "127.0.1.5", "whois": { "registrar": "Dynadot LLC.", "created": "2026-10-27T02:18:30Z", "updated": "2026-10-27T02:22:07Z", "expires": "2027-10-27T02:18:30Z", "nameservers": [ "denver.ns.cloudflare.com", "oaklyn.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-28T00:58:29Z", "analysis_at": "2026-10-27T10:46:58Z", "stats": { "timeout": 0, "harmless": 55, "malicious": 1, "suspicious": 0, "undetected": 36 }, "detections": { "alphaMountain.ai": "phishing" }, "reputation": 0, "tags": [ "dga" ], "categories": { "alphaMountain.ai": "Phishing (alphaMountain.ai)" }, "first_seen": "2026-10-27T02:29:06Z", "dns": [ { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "denver.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3031::ac43:c99f" }, { "ttl": 300, "type": "A", "value": "172.67.201.159" }, { "ttl": 300, "type": "A", "value": "104.21.36.252" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3034::6815:24fc" }, { "ttl": 21600, "type": "NS", "value": "denver.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "oaklyn.ns.cloudflare.com" } ], "dns_at": "2026-10-27T10:52:52Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "*.claim-xaman.app", "claim-xaman.app" ], "issuer": "Let's Encrypt / YE2", "serial": "5b89cff538178812d6282a0d7579c38ba9f", "sha256": "0374166f1b66e59943e201fe0cb0190b2e851e5a84c4a99f5c5f15b5343e1367", "subject": "claim-xaman.app", "valid_to": "2027-01-25T01:28:05Z", "valid_from": "2026-10-27T01:28:06Z" }, "rdap": { "status": [ "add period", "client transfer prohibited" ], "events": { "expiration": "2027-10-27T02:18:30Z", "last changed": "2026-10-27T02:18:45Z", "registration": "2026-10-27T02:18:30Z", "last update of RDAP database": "2026-10-27T02:28:56Z" }, "registrar": "Dynadot LLC.", "registrar_iana_id": "472" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-27T16:39:36Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "claim-xaman.app" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-27T16:34:31Z", "first": "2026-10-27T16:34:31Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 7979 }, "robots_txt": { "agents": [ "*", "Twitterbot" ], "present": true }, "sitemap": { "present": true, "url_count": 1 }, "social_tags": { "ogUrl": "https://xaman-portal.app/", "title": "Cold Storage in Your Pocket | Xaman", "ogType": "website", "robots": "index,follow,max-image-preview:large", "ogImage": "https://xaman-access.app/social-preview.png", "ogTitle": "Claim Your $XRP Airdrop Now", "ogSiteName": "Xaman", "themeColor": "#0030cf", "description": "Explore the Xaman airdrop for XRP holders, XRPL participants and Xaman Wallet users. Check eligibility and learn about allocations on the XRP Ledger.", "twitterCard": "summary_large_image", "canonicalUrl": "https://xaman-portal.app/", "ogDescription": "Explore the Xaman airdrop for XRP holders, XRPL participants and Xaman Wallet users. Check eligibility and learn about allocations on the XRP Ledger." }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 2, "tls": 21, "wait": 1142, "connect": 7, "download": 2 }, "response_ms": 1174 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 26409, "co2_grams": 0.001, "cleaner_than": 51 }, "dns_server": { "ns": [ { "ip": "162.159.44.196", "host": "denver.ns.cloudflare.com" }, { "ip": "172.64.34.90", "host": "oaklyn.ns.cloudflare.com" } ], "zone": "claim-xaman.app" }, "location": { "ip": "2606:4700:3031::ac43:c99f", "asn": "13335", "org": "Cloudflare, Inc.", "city": "Toronto", "country": "CA" }, "ssl": { "issuer": "Let's Encrypt / YE2", "subject": "claim-xaman.app" }, "dns": { "A": [ "104.21.36.252", "172.67.201.159" ], "NS": [ "oaklyn.ns.cloudflare.com", "denver.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"denver.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418569003, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "AAAA": [ "2606:4700:3031::ac43:c99f", "2606:4700:3034::6815:24fc" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "header": "max-age=63072000; includeSubDomains; preload", "message": "Site is compatible with the HSTS preload list!", "compatible": true }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": "1; mode=block", "permissionsPolicy": false, "xContentTypeOptions": "nosniff", "contentSecurityPolicy": "frame-ancestors http: https:", "strictTransportPolicy": "max-age=63072000; includeSubDomains; preload", "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2606:4700:3031::ac43:c99f", "family": 6 }, "redirects": { "chain": [ "https://claim-xaman.app" ] }, "tech_stack": { "technologies": [ "Priority Hints", "HSTS", "Cloudflare", "PWA", "Open Graph", "HTTP/3" ] }, "linked_pages": { "external": [ "https://xaman.app/security", "https://xaman.app/developers", "https://xaman.app/cards", "https://xaman.app/ecosystem", "https://xaman.app/blog", "https://help.xaman.app/app", "https://play.google.com/store/apps/details", "https://apps.apple.com/us/app/xaman-wallet-formerly-xumm/id1492302343", "https://xaman.app/", "https://xaman.app/pro", "https://xaman.app/download", "https://webflow-proxy-cdn.xaman.app/66ffb9c73bc7e83a1e0e1006/670662e9cd5f477f5b1dcad2_XRPL-Labs-Privacy-Statement-V1.pdf", "https://xrpl-labs.com/static/documents/XRPL-Labs-Terms-of-Service-V1.pdf", "https://github.com/XRPL-Labs/Xaman-Issue-Tracker/blob/master/RESPONSIBLE-DISCLOSURE.md", "https://xumm.app/detect/xapp:xumm.support", "https://x.com/xrpllabs", "https://x.com/XamanWallet", "https://xaman.app/contact", "https://xrpl-labs.com/static/documents/xaman-logos.zip", "https://xrpl-labs.com/static/documents/xaman-product.zip", "https://x.com/xamanwallet", "https://www.youtube.com/@XamanApp", "https://www.linkedin.com/company/13043030/" ], "external_count": 23, "internal_count": 1 }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html", "strict-transport-security": "max-age=63072000; includeSubDomains; preload", "content-security-policy": "frame-ancestors http: https:", "x-content-type-options": "nosniff" } } } } ```