# PhishDestroy domain threat record: xmantf.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/xmantf.com/ Machine-readable companion: https://phishdestroy.io/domain/xmantf.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-26 16:18:08 UTC - Last availability or vendor check: 2026-10-26 16:35:11 UTC - Stored record updated: 2026-10-26 19:36:46 UTC - VirusTotal detections in the stored snapshot: 1/92 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Trump Token ## Stored infrastructure - Observed IP address: 188.114.97.3 - Registrar in stored WHOIS data: Key-Systems GmbH - Registrar country in stored WHOIS data: US - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-10-22 09:21:48 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a1790f-002f-775d-9e96-048c5de7dfab/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/xmantf.com - Certificate Transparency search: https://crt.sh/?q=%25.xmantf.com - Web Archive lookup: https://web.archive.org/web/*/https://xmantf.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview The captured screenshot from 2026-10-26 shows a dark crypto exchange page with a centered Wallet modal layered over marketing bullets and market tickers. PhishDestroy listed the page as a crypto wallet drainer and first saw the domain on 2026-10-26, four days after its registration date. How the scam works The modal asked visitors to connect a wallet to sign in, stating that a new account is created automatically on first connection and prompting MetaMask or TronLink installation when no wallet was detected. As a category risk, this kind of wallet-connect flow can invoke drainer code that requests transactions or token approvals, so a visitor who signs may authorize asset transfers to an attacker-controlled party. Evidence The screenshot shows the cyan Connect wallet and sign in button, lures reading Zero Security Incidents, 100% Reserves and High Returns, Abundant Opportunities, plus an exchange notice warning about scams. URLScan's ML engine scored the capture 79 and tagged it malicious on 2026-10-26, while its overall verdict remained not malicious, and an earlier URLScan capture on 2026-10-24 was clean. VirusTotal did not flag the domain as malicious, though Ermes labelled it not recommended; Google Safe Browsing, OTX with 0 pulses, and external blocklists with 0 entries were unflagged on 2026-10-26, while PhishDestroy's internal blocklist flags it. The capture recorded 132 tracker requests and an HTTP to HTTPS 307 redirect. Infrastructure Registration was recorded on 2026-10-22 through Key-Systems GmbH, with Cloudflare nameservers and unsigned DNSSEC. The recorded address space was Cloudflare, and a Let's Encrypt certificate for xmantf.com was valid from 2026-10-22 to 2027-01-20 with HSTS set to max-age 31536000. Shared CDN addressing does not identify the operator. What to do Visitors who connected a wallet should revoke any connections, approvals or permissions granted through this page and move remaining assets to a fresh wallet, treating any exposed secret as compromised. Block xmantf.com at DNS or proxy level, keep it on blocklists, and correlate against the retained capture hashes. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a1790f-002f-775d-9e96-048c5de7dfab/ Cloudflare Radar report: https://radar.cloudflare.com/scan/adb6db25-771f-4333-8215-a4852b4b5d7d URLQuery report: https://urlquery.net/report/e0d4f99a-1098-4dc2-b46a-c2a84e892e41 Stored capture screenshot: https://urlscan.io/screenshots/01a1790f-002f-775d-9e96-048c5de7dfab.png Cloudflare Radar screenshot (2026-10-26T16:31:25Z): https://screenshots.phishdestroy.io/cf/adb6db25-771f-4333-8215-a4852b4b5d7d.png URLScan screenshot (2026-10-26T16:33:25Z): https://screenshots.phishdestroy.io/us/01a1790f-002f-775d-9e96-048c5de7dfab.png VirusTotal report: https://www.virustotal.com/gui/domain/xmantf.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=xmantf.com Revoke token approvals: https://revoke.cash/ Report crypto fraud (Chainabuse): https://www.chainabuse.com/report Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-26 17:46:31 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a1790f-002f-775d-9e96-048c5de7dfab.png Captured: 2026-10-26 16:35:11 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a1790f-002f-775d-9e96-048c5de7dfab.png Captured: 2026-10-26 16:35:11 UTC Source report: https://urlscan.io/result/01a1790f-002f-775d-9e96-048c5de7dfab/ - URLScan ยท 2026-10-24: https://screenshots.phishdestroy.io/us/01a16ce4-32a9-7768-93ac-530649ae4f9e.png Captured: 2026-10-24 07:51:25 UTC Source report: https://urlscan.io/result/01a16ce4-32a9-7768-93ac-530649ae4f9e/ SHA-256: 8ad29f98839b90f6b4de4d01571af67a792ccb00efb7586142ea77e683f99d25 - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/adb6db25-771f-4333-8215-a4852b4b5d7d.png Captured: 2026-10-26 16:31:25 UTC Source report: https://radar.cloudflare.com/scan/adb6db25-771f-4333-8215-a4852b4b5d7d SHA-256: ab18e25634d59a03827e69a44bd821f7e0149ae27f61075e2911a4b5ed26b844 - URLQuery: https://screenshots.phishdestroy.io/uq/e0d4f99a-1098-4dc2-b46a-c2a84e892e41.png Source report: https://urlquery.net/report/e0d4f99a-1098-4dc2-b46a-c2a84e892e41 SHA-256: 0c613a0a85ffb148e84985344f183d261321edfe444a69ab3994faa47066ea99 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-26T16:39:56Z", "uuid": "01a1790f-002f-775d-9e96-048c5de7dfab", "scanned_at": "2026-10-26T16:33:25Z", "final_url": "https://xmantf.com/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://xmantf.com/", "from": "http://xmantf.com/", "status": 307 } ], "ip": "188.114.96.3", "domains": [ "plugin-code.salesmartly.com", "msg.salesmartly.com", "srz.salesmartly.com", "widget.salesmartly.com", "flagcdn.com", "client.salesmartly.com", "api.salesmartly.com", "mix-ads.oss-accelerate.aliyuncs.com" ], "ips": [ "47.254.187.140", "104.18.23.242", "104.18.22.242", "2606:4700::6812:17f2", "172.67.180.104", "2600:9000:2490:c600:17:cdfa:4740:93a1", "2600:9000:266e:7400:1b:20a4:b040:93a1", "188.114.96.3" ], "asns": [ "45102", "13335", "16509" ], "countries": [ "DE", "US" ], "doc_hash": "7f96a351dd0947fe457f4153fd315340b38c607a1fae1a8691ffb8391fd37305", "script_hashes": [ "bcee984fd52b4a82bd6b23543bb33f6472e076c125edbdd8756d29ca230628cb", "4f749db56360d1ffd81aebf85fd1ef13b30b3ed9b8192bf380e1e3e8295060fa", "4d8fbcc2b543ccb7ea7e469029159e0726102ccc371a12e55b410dd6be407bad", "43fa933f8eb1f11721958d59a1d445bff90037e8b9594873c4cb605636f3876f", "9c5606f93b3a1ac05544ed60173eeed2968235543a990f514fca5f90bd5fcaa1", "c21bbc756967bab1c7d639f37b0b620379b5973fb56cdabe7375ae9211b9a7dc", "832f3979a7158837813798f48ddc0c3d8431d4cda5d304e05f3ed4be1fc61282", "03b1f9ae520178951ced7576de8488c640b0f957db11181524fc57f09513ded3", "d72c2dda26b029ee5dce1902956eb20a9dc6545b6ef89ef770fbc4e11548e392", "02a73e42981873d7ede2394212ed0b8732b1929048c8c757cae844a410ff070c" ], "globals": [ "TradingView", "addLink", "addMeta", "lib", "rem", "dpr", "__VUE_INSTANCE_SETTERS__", "__VUE_SSR_SETTERS__", "__INTLIFY_PROD_DEVTOOLS__", "__INTLIFY_JIT_COMPILATION__", "__INTLIFY_DROP_MESSAGE_COMPILER__", "__VUE_I18N_FULL_INSTALL__", "__VUE_I18N_LEGACY_API__", "PubSub", "__config", "__theme", "__removeStartupSplash__", "__VUE__", "__vite_is_modern_browser", "locale", "__ssc", "ssq", "__read", "__spreadArray", "__SS_CHAT_RUNTIME__", "__SS_CHAT_SCRIPT_MODE__", "SHOPINFO", "ASSETS_HOSTNAME_VARIABLE", "ASSETS_CDN_HOSTNAME_VARIABLE", "STATIC_HOSTNAME_VARIABLE", "__SS_CHAT_SHADOWROOT__", "ssmEvent", "saveAs", "marked", "__SS_MARKED_CONFIGURED__" ], "cookies": [ "ss_uid", "_ss_s_uid" ], "storage_keys": [ "trustdefi_THEME", "main", "salesmartly_p_g21bdr8_session_tab_key", "salesmartly_p_g21bdr8_u_i", "salesmartly_p_g21bdr8_custom_fields_local_map", "salesmartly_p_g21bdr8_p_xma_", "salesmartly_p_g21bdr8_g_uid", "salesmartly_p_g21bdr8_token_date", "salesmartly_p_g21bdr8_token", "ss_p_c_l_v_pro", "salesmartly_p_g21bdr8_n_u" ], "tls": { "san": [ "*.xmantf.com", "xmantf.com" ], "cipher": "AES_128_GCM", "issuer": "YE2", "subject": "xmantf.com", "protocol": "QUIC", "valid_to": "2027-01-20T10:32:02Z", "valid_from": "2026-10-22T10:32:03Z" }, "domain_age_days": 2260, "apex_age_days": 2260, "tls_age_days": 4, "tls_valid_days": 89, "requests": 159, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 79, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html", "strict-transport-security": "max-age=31536000" } }, "cf": { "v": 1, "fetched_at": "2026-10-26T16:39:58Z", "uuid": "adb6db25-771f-4333-8215-a4852b4b5d7d", "scanned_at": "2026-10-26T16:31:25Z", "final_url": "https://xmantf.com/", "status": 200, "history": [ { "url": "https://xmantf.com/", "status": 200 } ], "dom_hash": "8f83cb5f93fd3ee8d98489dbe70c9fa4cc2713700b9ea195ac576be05247e66f", "doc_hash": "f8e78043e1218f494e57db762d6d8c5b72590af9871452682116211989b219d7", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "xmantf.com", "type": "A", "value": "188.114.96.0" }, { "name": "xmantf.com", "type": "A", "value": "188.114.97.0" }, { "name": "xmantf.com", "type": "AAAA", "value": "2a06:98c1:3120::" }, { "name": "xmantf.com", "type": "AAAA", "value": "2a06:98c1:3121::" } ], "dnssec_valid": false, "ip": "188.114.96.0", "whois": { "registrar": "Key-Systems GmbH", "created": "2026-10-22T11:21:48Z", "updated": "2026-10-22T11:36:59Z", "expires": "2027-10-22T11:21:48Z", "nameservers": [ "eloise.ns.cloudflare.com", "sid.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-26T16:28:08Z", "analysis_at": "2026-10-23T02:16:52Z", "stats": { "timeout": 0, "harmless": 52, "malicious": 0, "suspicious": 1, "undetected": 39 }, "detections": { "Ermes": "not recommended" }, "reputation": 0, "registrar": "Key-Systems GmbH", "created": "2026-10-22T11:21:48Z", "expires": "2027-10-22T11:21:48Z", "updated": "2026-10-22T11:36:59Z", "first_seen": "2026-10-22T14:18:35Z", "dns": [ { "ttl": 21600, "type": "NS", "value": "eloise.ns.cloudflare.com" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "eloise.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "172.67.203.210" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3031::6815:5ab8" }, { "ttl": 21600, "type": "NS", "value": "sid.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "104.21.90.184" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3033::ac43:cbd2" } ], "dns_at": "2026-10-23T02:25:55Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "*.xmantf.com", "xmantf.com" ], "issuer": "Let's Encrypt / YE2", "serial": "5775577f5e47ab38f059d4b83d260e1828a", "sha256": "3cad642b83c01f1d2bb17bc12aecffa16585c2e0b89ef81d9f6628a37122fd15", "subject": "xmantf.com", "valid_to": "2027-01-20T10:32:02Z", "valid_from": "2026-10-22T10:32:03Z" }, "whois": { "registrar": "Key-Systems GmbH", "registrar_iana_id": "269", "registrar_url": "http://www.key-systems.net", "created": "2026-10-22T11:21:48Z", "updated": "2026-10-22T11:36:59Z", "expires": "2027-10-22T11:21:48Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "eloise.ns.cloudflare.com", "sid.ns.cloudflare.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "client transfer prohibited" ], "events": { "expiration": "2027-10-22T11:21:48Z", "last changed": "2026-10-22T11:36:59Z", "registration": "2026-10-22T11:21:48Z", "registrar expiration": "2027-10-22T11:21:48Z", "last update of RDAP database": "2026-10-22T14:33:10Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-26T16:40:20Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "xmantf.com" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-26T16:24:39Z", "first": "2026-10-26T16:24:39Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 3588 }, "social_tags": { "title": "TRUMPCOIN", "robots": "all", "ogImage": "/platform/dev/logo_144.png?2.0.1792101169845", "ogTitle": "TRUMPCOIN", "keywords": "undefined", "themeColor": "#ffffff", "description": "undefined", "ogDescription": "undefined" }, "trackers": { "requests": 132 }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 22, "tls": 30, "wait": 657, "connect": 7, "download": 0 }, "response_ms": 716 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 6774, "co2_grams": 0.0002, "cleaner_than": 80 }, "dns_server": { "ns": [ { "ip": "173.245.59.143", "host": "sid.ns.cloudflare.com" }, { "ip": "172.64.34.208", "host": "eloise.ns.cloudflare.com" } ], "zone": "xmantf.com" }, "location": { "ip": "2a06:98c1:3121::3", "asn": "13335", "org": "CloudFLARENET-EU", "city": "London", "country": "GB" }, "ssl": { "issuer": "Let's Encrypt / YE2", "subject": "xmantf.com" }, "dns": { "A": [ "188.114.97.3", "188.114.96.3" ], "NS": [ "eloise.ns.cloudflare.com", "sid.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"eloise.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418177015, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "AAAA": [ "2a06:98c1:3121::3", "2a06:98c1:3120::3" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "header": "max-age=31536000", "message": "HSTS header does not include all subdomains." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": "max-age=31536000", "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2a06:98c1:3121::3", "family": 6 }, "redirects": { "chain": [ "https://xmantf.com" ] }, "whois": { "registrar": "Key-Systems GmbH", "created": "2026-10-22T11:21:48Z", "updated": "2026-10-22T11:36:59Z", "expires": "2027-10-22T11:21:48Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "eloise.ns.cloudflare.com", "sid.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html", "strict-transport-security": "max-age=31536000" } } } } ```