# PhishDestroy threat dossier — token-xamanwallet.pro ================================================================ Fetched: 2026-05-14 13:51:43 UTC Canonical: https://phishdestroy.io/domain/token-xamanwallet.pro/ ## VERDICT ---------------------------------------------------------------- ACTIVE THREAT — multiple warning signs Composite threat score: 47/100 (PhishDestroy scoring — see methodology below) Targeted brand: OKX ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 0/95 security vendors flagged this domain URLQuery: 2 detections ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 172.67.218.112 Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com Nameservers: anton.ns.cloudflare.com, nina.ns.cloudflare.com Registered: 2026-05-11 Expires: 2027-05-11 Page title: Cold Storage in Your Pocket | Xaman HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / E7 Expires: 2026-08-09 Status: INVALID chain Fingerprint: 0d69f919bfaa8cf19b8a2ccd2f65ba6716bb586f252745433a97a3aff386bbaf ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-05-11 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-05-14 13:42:30 UTC (by PhishDestroy tracker) First reported: 2026-05-14 10:43:25 UTC (abuse notice filed) Last verified: 2026-05-14 16:00:05 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019e2614-2ffd-73d9-9e54-a41529e4aaee/ URLQuery: https://urlquery.net/report/4c90f036-1806-486d-bab7-7da4a62d6d14 Wayback Machine: https://web.archive.org/web/*/token-xamanwallet.pro crt.sh CT logs: https://crt.sh/?q=%25.token-xamanwallet.pro Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=token-xamanwallet.pro AlienVault OTX: https://otx.alienvault.com/indicator/domain/token-xamanwallet.pro URLhaus: https://urlhaus.abuse.ch/host/token-xamanwallet.pro/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-05-14 13:43:30 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy has flagged token-xamanwallet.pro as an active brand impersonation domain targeting OKX users. This domain is currently under investigation but remains accessible and poses an immediate threat to cryptocurrency investors. The site mimics OKX’s Xaman wallet branding to deceive victims into entering sensitive wallet credentials or downloading malicious software. This tactic is part of a growing trend where threat actors exploit brand recognition to execute high-conviction phishing campaigns with minimal detection resistance. This domain was registered on May 11, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to IP address 172.67.218.112. It uses a Let's Encrypt SSL certificate to appear legitimate and currently shows 0 detections out of 95 scans on VirusTotal, with no presence on known blocklists or threat intelligence feeds. The combination of a newly registered domain, lack of detection coverage, and active hosting infrastructure suggests a purpose-built phishing resource designed to evade early detection. To mitigate exposure to this campaign, users should avoid accessing the domain entirely and verify wallet URLs through official OKX channels. Organizations should monitor for employee access to this domain via DNS logs or endpoint detection tools. If interaction has already occurred, clear browser cache and cookies, scan devices for malware, and rotate all associated cryptocurrency wallet credentials. Always confirm the authenticity of wallet-related domains directly through official OKX communication channels before proceeding with any transaction or login attempt. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260514-455675 Favicon MD5: 95704a3e043344cb369901ce67683f0c TLS cert SHA-256: 0d69f919bfaa8cf19b8a2ccd2f65ba6716bb586f252745433a97a3aff386bbaf ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/token-xamanwallet.pro/ JSON API: https://api.destroy.tools/v1/check?domain=token-xamanwallet.pro Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 149,073 domains (40,812 alive under monitoring, 107,907 confirmed takedowns/dead). Site: https://phishdestroy.io