xaman-app[.]world

Analysis of xaman-app.world shows a newly registered domain (created February 21, 2026) that is currently offline but was previously identified as a crypto‑focused impersonation campaign targeting Google. The site presented the page title "Xaman – Secure & Powerful XRP Wallet. Manage Your Crypto Easily," indicating a cryptocurrency wallet theme rather than a genuine Google service. Infrastructure details reveal the domain resolves to IP address 172.67.141.154, hosted within the United States under ASN 13335 operated by Cloudflare, Inc. Registration was performed through NameCheap, Inc., and the domain uses Cloudflare nameservers sky.ns.cloudflare.com and zod.ns.cloudflare.com. No SSL certificate was observed, meaning HTTPS was not configured at the time of capture.

Threat intelligence indicates that 2 of 93 VirusTotal security vendors flagged the domain, and it appears on three external blocklists. Specific blocklist entries from PhishDestroy, MetaMask, and SEAL have already blocked the domain, reinforcing its malicious classification. Gridinsoft assigned a trust score of 0 out of 100, reflecting a high confidence in its malicious nature. The brand target is explicitly listed as Google, confirming a brand‑impersonation intent, while the scam type is identified as a crypto scam.

Defenders should continue to monitor the IP address 172.67.141.154 for any reactivation, enforce blocking of the domain at perimeter defenses, and add the associated IP and hostnames to internal blocklists. Given the lack of HTTPS, any future attempts to serve content over TLS would be a notable change in behavior that should trigger alerts. Since the domain is already offline, remediation focuses on preventing re‑use of the same infrastructure and ensuring that any residual traffic is dropped. Continuous review of the three blocklists and periodic rescans with multi‑vendor services are recommended to capture any updates to the threat profile.