# reward-xaman.pages.dev Xaman Airdrop Claim Page | PhishDestroy Content language: English Canonical HTML report: https://phishdestroy.io/domain/reward-xaman.pages.dev/ Machine-readable companion: https://phishdestroy.io/domain/reward-xaman.pages.dev/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: Reachable · access restricted - First observed by PhishDestroy: 2026-10-31 22:20:15 UTC - Selected availability observation: 2026-11-05T02:24:18Z - Stored record updated: 2026-11-05 11:24:24 UTC - VirusTotal detections in the stored snapshot: 4/92 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: checked_clean ## Stored labels and detections - Automated brand label (collector metadata; not a confirmed impersonation finding): Xaman - Phishing kit: Airdrop Scam ## Stored infrastructure - Observed IP address: 172.66.47.195 - Registrar in stored WHOIS data: Cloudflare, Inc. - Last stored HTTP status: 403 (observed: 2026-11-05T02:24:18Z) - Registration date (registry RDAP, pages.dev): 2020-09-02 02:33:29 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a1940a-bf50-769a-a794-4c02d6b9b8c0/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/reward-xaman.pages.dev - Certificate Transparency search: https://crt.sh/?q=%25.reward-xaman.pages.dev - Web Archive lookup: https://web.archive.org/web/*/https://reward-xaman.pages.dev/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Public report package PhishDestroy records reward-xaman.pages.dev, a page presenting an activated Xaman Airdrop with a claim button for XRP holders. The captured page at reward-xaman.pages.dev carries the headline "The Xaman Airdrop Is Activated" above text addressed to XRP holders, XRPL participants and Xaman Wallet users, inviting them to check whether they qualify for an allocation. The page states that eligible distributions go directly to the user's wallet on the XRP Ledger, and its main interaction is a prominent blue "Claim Airdrop" button beneath that copy. The page also shows Xaman-branded navigation and product imagery. The stored VirusTotal domain result reports 4 detections out of 92 engines. ESET reported "phishing"; SOCRadar reported "phishing". Package revision: c1fbe57ca578cfc1af861a5386a3556040431c8f4b7836d50f7f8f576f5e2560 Text generated (not scan time): 2026-10-31 23:26:07 Reviewed evidence snapshot: {"domain":"reward-xaman.pages.dev","screenshot_available":true,"page_title":"Xaman Airdrop | XRP Qualify","original_meta_description":"Explore the Xaman airdrop for XRP holders, XRPL participants and Xaman Wallet users. Check eligibility and learn about allocations on the XRP Ledger.","initial_ai_description":"The site impersonates Xaman and offers an 'Airdrop' for XRP holders, which is a common tactic for cryptocurrency scams to trick users into connecting their wallets or revealing seed phrases. The domain 'reward-xaman.pages.dev' is not the official Xaman domain.","metadata_observed_on":"2026-10-31","initial_ai_description_kind":"previous AI opinion, not independent evidence","virustotal":{"detections":4,"engines":92,"malicious":4,"suspicious":0,"retrieved_date":"2026-10-31","analysis_date":"2026-10-30","flagging_vendors":["ESET","SOCRadar","Kaspersky","alphaMountain.ai"],"vendor_labels":{"ESET":"phishing","SOCRadar":"phishing","Kaspersky":"phishing","alphaMountain.ai":"phishing"},"scope":"domain"},"capture_context":{"relationship":"screenshot associated with this domain record","captured_at":"2026-10-31T22:22:39Z","final_host":"reward-xaman.pages.dev","captured_on":"2026-10-31"},"virustotal_public_summary":"The stored VirusTotal domain result reports 4 detections out of 92 engines. ESET reported \"phishing\"; SOCRadar reported \"phishing\".","page_paragraph_target_characters":517} Source facts (timestamps as stored): {"record_id":1724183,"first_recorded_at":"2026-10-31 23:20:15","virustotal":{"source":"VirusTotal","scope":"unknown","result_state":"complete","numerator":4,"denominator":92,"malicious":4,"suspicious":0,"vendors":{"ESET":"phishing","SOCRadar":"phishing","Kaspersky":"phishing","alphaMountain.ai":"phishing"},"observed_at":"2026-10-30T20:56:59Z","checked_at":null,"fetched_at":"2026-10-31T22:22:10Z","time_basis":"UTC (provider ISO timestamps)","stored_summary":{"source":"VirusTotal","scope":"unknown","result_state":"observed","numerator":4,"denominator":92,"malicious":null,"suspicious":null,"vendors":["alphaMountain.ai","ESET","Kaspersky","SOCRadar"],"observed_at":"2026-10-30 20:56:59","checked_at":"2026-10-31 23:22:11","fetched_at":"2026-10-31 22:22:11","time_basis":"as stored; legacy timezone not established"},"record_source":"phishdestroy.technologies.vt","vendor_labels":{"ESET":"phishing","SOCRadar":"phishing","Kaspersky":"phishing","alphaMountain.ai":"phishing"},"vendor_names":["ESET","SOCRadar","Kaspersky","alphaMountain.ai"],"stats":{"timeout":0,"harmless":55,"malicious":4,"suspicious":0,"undetected":33}},"google_safe_browsing":{"source":"Google Safe Browsing","state":"checked_clean","verdict":0,"checked_at":"2026-10-31 23:22:24"},"spamhaus":{"source":"Spamhaus","verdict":null,"checked_at":"2026-11-01 00:30:28"},"availability":{"state":"restricted","label_key":"availability.access_restricted","detail_key":"detail.restricted","params":[],"source":"current_http_probe","record_id":1724183,"scope":"checked_url","observed_at":"2026-11-05T02:24:18Z","http_status":403,"http_observed_at":"2026-11-05T02:24:18Z","stored_http_code":403,"stored_http_observed_at":"2026-11-05T02:24:18Z","legacy_site_status":"dead","supports_outcome_badge":false,"content_classification":"provider_blocked","content_classification_at":"2026-11-05T02:24:18Z","registration_state":"unknown","policy":"20261102-dated-availability-v2"}} ## Stored page captures - Stored capture: https://i.ibb.co/21kM0cSg/335bfcf1d48f.png - URLScan · 2026-10-31: https://screenshots.phishdestroy.io/01a1940a-bf50-769a-a794-4c02d6b9b8c0.png Captured: 2026-10-31 22:18:21 UTC Source report: https://urlscan.io/result/01a1940a-bf50-769a-a794-4c02d6b9b8c0/ - URLScan · 2026-10-29: https://screenshots.phishdestroy.io/us/01a189ae-2072-707c-9ef8-f903b30ec272.png Captured: 2026-10-29 22:01:00 UTC Source report: https://urlscan.io/result/01a189ae-2072-707c-9ef8-f903b30ec272/ SHA-256: 29cad6ac5a043c06c8ac56f505cc777b5a986cd412088cf9cb45ccda3724277d - URLScan · 2026-10-29: https://screenshots.phishdestroy.io/us/01a189ae-1d1b-762e-8489-6937db1f327f.png Captured: 2026-10-29 22:01:01 UTC Source report: https://urlscan.io/result/01a189ae-1d1b-762e-8489-6937db1f327f/ SHA-256: 801b9038f38433fcd3ef3d8f51415ce7457cfc20c12324d4bf14035a1a3daf0d - URLScan · 2026-10-31: https://screenshots.phishdestroy.io/us/01a19400-fa15-7610-b5ec-8ca8055c4881.png Captured: 2026-10-31 22:07:42 UTC Source report: https://urlscan.io/result/01a19400-fa15-7610-b5ec-8ca8055c4881/ SHA-256: 8da0fcf8c96e5fb121851dab12c798c071622ec7e8efec93411c925618fe2e09 - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/30599427-e3d2-428e-a98b-6081e29b87c3.png Captured: 2026-10-31 22:22:39 UTC Source report: https://radar.cloudflare.com/scan/30599427-e3d2-428e-a98b-6081e29b87c3 SHA-256: 6d224380f6f841326e2974e20549ce9a714e686bb1827c6ec4e5795338041b87 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-31T22:24:58Z", "uuid": "01a1940a-bf50-769a-a794-4c02d6b9b8c0", "scanned_at": "2026-10-31T22:18:21Z", "final_url": "https://reward-xaman.pages.dev/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://reward-xaman.pages.dev/", "from": "http://reward-xaman.pages.dev/", "status": 307 } ], "ip": "172.66.44.61", "domains": [ "xrpl-scaner.com", "crossmark.io", "play-lh.googleusercontent.com", "pbs.twimg.com", "api.ipify.org" ], "ips": [ "172.67.162.171", "76.76.21.21", "2a00:1450:4001:c25::77", "2a04:4e42:8d::159", "104.26.13.205", "172.66.44.61" ], "asns": [ "13335", "16509", "15169", "54113" ], "countries": [ "US", "DE" ], "link_domains": [ "xaman.app", "help.xaman.app", "play.google.com", "apps.apple.com", "webflow-proxy-cdn.xaman.app", "xrpl-labs.com", "github.com", "xumm.app", "x.com", "www.youtube.com", "www.linkedin.com" ], "social": [ "https://github.com/XRPL-Labs/Xaman-Issue-Tracker/blob/master/RESPONSIBLE-DISCLOSURE.md", "https://x.com/xrpllabs", "https://x.com/XamanWallet", "https://x.com/xamanwallet", "https://www.youtube.com/@XamanApp" ], "doc_hash": "c32fccd0124576154253752ddae0e4c14079305dcf4fd508a96d00545350cda1", "script_hashes": [ "696c135f7ad08d2714a53e8e68b37b17554185780741fb7c0896ad94601b1e15", "c32fccd0124576154253752ddae0e4c14079305dcf4fd508a96d00545350cda1", "f43ae3a4555fa565144ce3214e6aabc8db42fe2916f131146c9682fcb8e84950" ], "globals": [ "_0x1c9d", "_0x3699", "_0x42b876", "__ledgerLogsListen", "XRPLWalletConnect", "__xamanSeedP", "subscribeButton", "emailInput", "subscription" ], "tls": { "san": [ "*.reward-xaman.pages.dev", "reward-xaman.pages.dev" ], "cipher": "AES_128_GCM", "issuer": "YE2", "subject": "reward-xaman.pages.dev", "protocol": "QUIC", "valid_to": "2027-01-27T20:59:06Z", "valid_from": "2026-10-29T20:59:07Z" }, "domain_age_days": 2, "apex_age_days": 2, "tls_age_days": 2, "tls_valid_days": 89, "requests": 32, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 99, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "genericcrypto" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Generic Crypto" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin", "priority": "u=0,i" } }, "cf": { "v": 1, "fetched_at": "2026-10-31T22:25:00Z", "uuid": "30599427-e3d2-428e-a98b-6081e29b87c3", "scanned_at": "2026-10-31T22:22:39Z", "final_url": "https://reward-xaman.pages.dev/", "status": 200, "history": [ { "url": "https://reward-xaman.pages.dev/", "status": 200 } ], "dom_hash": "ae26fc46fa08dfffe392daa5f6e86ababd7dd3073b4e57b915f77969aec793bd", "doc_hash": "c32fccd0124576154253752ddae0e4c14079305dcf4fd508a96d00545350cda1", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "reward-xaman.pages.dev", "type": "A", "value": "172.66.47.195" }, { "name": "reward-xaman.pages.dev", "type": "A", "value": "172.66.44.61" }, { "name": "reward-xaman.pages.dev", "type": "AAAA", "value": "2606:4700:310c::ac42:2fc3" }, { "name": "reward-xaman.pages.dev", "type": "AAAA", "value": "2606:4700:310c::ac42:2c3d" } ], "dnssec_valid": false, "ip": "127.0.1.13", "whois": { "registrar": "CloudFlare, Inc.", "created": "2020-09-02T02:33:29Z", "updated": "2026-06-09T12:00:52Z", "expires": "2027-09-02T02:33:29Z", "nameservers": [ "adi.ns.cloudflare.com", "karl.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-31T22:22:10Z", "analysis_at": "2026-10-30T20:56:59Z", "stats": { "timeout": 0, "harmless": 55, "malicious": 4, "suspicious": 0, "undetected": 33 }, "detections": { "ESET": "phishing", "SOCRadar": "phishing", "Kaspersky": "phishing", "alphaMountain.ai": "phishing" }, "reputation": 0, "tags": [ "dga" ], "categories": { "alphaMountain.ai": "Phishing (alphaMountain.ai)" }, "registrar": "CloudFlare, Inc.", "created": "2020-09-02T02:33:29Z", "expires": "2026-09-02T02:33:29Z", "updated": "2025-03-17T14:56:22Z", "first_seen": "2026-10-29T23:10:54Z", "dns": [ { "ttl": 300, "type": "A", "value": "172.66.44.61" }, { "ttl": 300, "type": "A", "value": "172.66.47.195" }, { "ttl": 21600, "type": "NS", "value": "brett.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:310c::ac42:2c3d" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:310c::ac42:2fc3" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "brett.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "summer.ns.cloudflare.com" } ], "dns_at": "2026-10-30T21:00:10Z", "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6", "cert": { "san": [ "*.reward-xaman.pages.dev", "reward-xaman.pages.dev" ], "issuer": "Let's Encrypt / YE2", "serial": "6c0037a92e4c6de616eee6907cd2dc3e03", "sha256": "beb4ae307f10cd08708feec125b6d35e3d8a78c0c7531bcd3f8079925f6d0e9f", "subject": "reward-xaman.pages.dev", "valid_to": "2027-01-27T20:59:06Z", "valid_from": "2026-10-29T20:59:07Z" }, "whois": { "registrar": "CloudFlare, Inc.", "registrar_iana_id": "1910", "registrar_url": "None", "created": "2020-09-02T02:33:29Z", "updated": "2023-09-04T18:15:07Z", "expires": "2026-09-02T02:33:29Z", "status": [ "clientDeleteProhibited", "clientTransferProhibited", "clientUpdateProhibited", "clientdeleteprohibited", "clienttransferprohibited", "clientupdateprohibited" ], "nameservers": [ "adi.ns.cloudflare.com", "karl.ns.cloudflare.com" ], "dnssec": "unsigned" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-31T22:25:22Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "reward-xaman.pages.dev" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "robots_txt": { "agents": [ "Twitterbot", "*" ], "present": true }, "sitemap": { "present": true, "url_count": 1 }, "social_tags": { "ogUrl": "https://xaman-promo.app/", "title": "Xaman Airdrop | XRP Qualify", "ogType": "website", "robots": "index,follow,max-image-preview:large", "ogImage": "https://xaman-promo.app/social-preview.png", "ogTitle": "Claim Your $XRP Airdrop Now", "ogSiteName": "Xaman", "themeColor": "#0030cf", "description": "Explore the Xaman airdrop for XRP holders, XRPL participants and Xaman Wallet users. Check eligibility and learn about allocations on the XRP Ledger.", "twitterCard": "summary_large_image", "canonicalUrl": "https://xaman-promo.app/", "ogDescription": "Explore the Xaman airdrop for XRP holders, XRPL participants and Xaman Wallet users. Check eligibility and learn about allocations on the XRP Ledger." }, "trackers": { "requests": 28, "trackers": [ { "name": "Google User Content", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "ipify", "company": "ipify", "category": "Misc", "requests": 1 }, { "name": "X Corp.", "company": "X Corp.", "country": "US", "category": "Social Media", "requests": 1 } ] }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 3, "tls": 90, "wait": 62, "connect": 8, "download": 1 }, "response_ms": 164 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 27762, "co2_grams": 0.001, "cleaner_than": 50 }, "dns_server": { "ns": [ { "ip": "162.159.38.9", "host": "summer.ns.cloudflare.com" }, { "ip": "173.245.59.76", "host": "brett.ns.cloudflare.com" } ], "zone": "reward-xaman.pages.dev" }, "location": { "ip": "2606:4700:310c::ac42:2fc3", "asn": "13335", "org": "Cloudflare, Inc.", "city": "Montreal", "country": "CA" }, "ssl": { "issuer": "Let's Encrypt / YE2", "subject": "reward-xaman.pages.dev" }, "dns": { "A": [ "172.66.44.61", "172.66.47.195" ], "NS": [ "brett.ns.cloudflare.com", "summer.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"brett.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418801154, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "AAAA": [ "2606:4700:310c::ac42:2fc3", "2606:4700:310c::ac42:2c3d" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": "strict-origin-when-cross-origin", "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": "nosniff", "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2606:4700:310c::ac42:2c3d", "family": 6 }, "redirects": { "chain": [ "https://reward-xaman.pages.dev" ] }, "linked_pages": { "external": [ "https://xaman.app/security", "https://xaman.app/developers", "https://xaman.app/cards", "https://xaman.app/ecosystem", "https://xaman.app/blog", "https://help.xaman.app/app", "https://play.google.com/store/apps/details", "https://apps.apple.com/us/app/xaman-wallet-formerly-xumm/id1492302343", "https://xaman.app/", "https://xaman.app/pro", "https://xaman.app/download", "https://webflow-proxy-cdn.xaman.app/66ffb9c73bc7e83a1e0e1006/670662e9cd5f477f5b1dcad2_XRPL-Labs-Privacy-Statement-V1.pdf", "https://xrpl-labs.com/static/documents/XRPL-Labs-Terms-of-Service-V1.pdf", "https://github.com/XRPL-Labs/Xaman-Issue-Tracker/blob/master/RESPONSIBLE-DISCLOSURE.md", "https://xumm.app/detect/xapp:xumm.support", "https://x.com/xrpllabs", "https://x.com/XamanWallet", "https://xaman.app/contact", "https://xrpl-labs.com/static/documents/xaman-logos.zip", "https://xrpl-labs.com/static/documents/xaman-product.zip", "https://x.com/xamanwallet", "https://www.youtube.com/@XamanApp", "https://www.linkedin.com/company/13043030/" ], "external_count": 23, "internal_count": 1 }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin" } } } } ``` Capture recorded with this analysis (source URL, capture time and stored hash): {"url":"https://screenshots.phishdestroy.io/cf/30599427-e3d2-428e-a98b-6081e29b87c3.png","source":"Cloudflare Radar","report_url":"https://radar.cloudflare.com/scan/30599427-e3d2-428e-a98b-6081e29b87c3","captured_at":"2026-10-31T22:22:39Z","sha256":"6d224380f6f841326e2974e20549ce9a714e686bb1827c6ec4e5795338041b87","model_image_sha256":"1fff015a28e74170606f643667506b09cdb6bf6f8806322f239c591eee851128","available":true,"content_status":null} ## Complete dated records Availability observations: https://phishdestroy.io/domain/reward-xaman.pages.dev/records.json?source=availability&format=json Source observation history: https://phishdestroy.io/domain/reward-xaman.pages.dev/records.json?source=detections&format=json PhishStats records: https://phishdestroy.io/domain/reward-xaman.pages.dev/records.json?source=phishstats&format=json Sent report records: https://phishdestroy.io/domain/reward-xaman.pages.dev/records.json?source=sent_reports&format=json Report history: https://phishdestroy.io/domain/reward-xaman.pages.dev/records.json?source=report_history&format=json Repeat report records: https://phishdestroy.io/domain/reward-xaman.pages.dev/records.json?source=rereports&format=json Follow-up records: https://phishdestroy.io/domain/reward-xaman.pages.dev/records.json?source=followups&format=json Content observations: https://phishdestroy.io/domain/reward-xaman.pages.dev/records.json?source=content&format=json ## Dated availability observation Reachable response; page content was not verified ```json { "state": "restricted", "label_key": "availability.access_restricted", "detail_key": "detail.restricted", "params": [], "source": "current_http_probe", "record_id": 1724183, "scope": "checked_url", "observed_at": "2026-11-05T02:24:18Z", "http_status": 403, "http_observed_at": "2026-11-05T02:24:18Z", "stored_http_code": 403, "stored_http_observed_at": "2026-11-05T02:24:18Z", "legacy_site_status": "dead", "supports_outcome_badge": false, "content_classification": "provider_blocked", "content_classification_at": "2026-11-05T02:24:18Z", "registration_state": "unknown", "policy": "20261102-dated-availability-v2" } ```