# en-xaman.top — SUSPICIOUS

> en-xaman.top mimics Xaman XRP Wallet to steal info. Stay alert and avoid this phishing site. Learn how to protect yourself now.

## Summary
PhishDestroy has identified en-xaman.top as an active brand impersonation phishing domain targeting users of the Xaman XRP Wallet. The site is designed to deceive visitors by presenting itself as the official Xaman wallet platform, using the page title "Xaman – The Ultimate XRP Wallet® for Secure & Easy Management" to lend credibility and lure victims into providing sensitive information.

Technical analysis reveals that en-xaman.top was registered on March 11, 2026, through 耐思尼克国际集团有限公司 and resolves to the IP address 172.67.206.34. The domain is currently flagged by 4 out of 95 security vendors on VirusTotal and appears on three distinct security blocklists, confirming its malicious intent. These indicators highlight the domain’s integration into phishing infrastructure aimed at exploiting the Xaman brand’s reputation.

Despite detection, en-xaman.top remains active and continues to pose a medium-level risk to users. PhishDestroy recommends avoiding any interaction with this domain and urges the Xaman community to verify URLs carefully. Reporting suspicious domains like en-xaman.top helps enhance protection efforts and mitigate phishing threats targeting cryptocurrency wallets.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: alive (HTTP 530)
- Target brand: Xaman
- Page title: Xaman – The Ultimate XRP Wallet® for Secure & Easy Management

## Domain Intelligence
- Registered: 2026-03-11 15:07:01
- Registrar: 耐思尼克国际集团有限公司
- Country: HK
- IP: 172.67.206.34
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: ["dana.ns.cloudflare.com.", "grant.ns.cloudflare.com."]
- SSL Issuer: none

## Detection Status
- VirusTotal: 4 vendors flagged
  Vendors: ["Ermes", "Fortinet", "Gridinsoft", "SOCRadar"]
- Google Safe Browsing: clean
- Blocklists: 3 hits
  Lists: ["PhishDestroy", "MetaMask", "SEAL"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019ce640-b65f-7409-8f50-a8ffc723edf7.png
- PhishDestroy: https://phishdestroy.io/domain/en-xaman.top/
- LLM endpoint: https://phishdestroy.io/domain/en-xaman.top/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/en-xaman.top/
Last updated: 2026-03-19