xamanwallet-xapps[.]com

This domain, xamanwallet-xapps.com, is identified as a crypto drainer, a threat type designed to siphon cryptocurrency from compromised wallets. Analysis indicates it impersonates the legitimate Xaman Wallet service to deceive users into executing unauthorized transactions. The domain is currently offline, though prior activity suggests it was actively targeting victims before takedown measures were implemented. Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on May 26, 2026, an unusually future-dated registration that may indicate evasion tactics. It resolved to the IP address 84.32.84.229 and was flagged by 15 of 95 security vendors on VirusTotal. The domain appears on three security blocklists and is blocked by MetaMask, PhishDestroy, and SEAL. A Gridinsoft trust score of 0/100 further confirms its malicious classification. Detected technologies include Hostinger CDN and HTTP/3, which may have been leveraged to obscure traffic or enhance delivery speed. The page title, 'Checking your browser before accessing. Just a moment...,' is consistent with tactics used to delay detection while loading malicious payloads. The domain is currently offline, though its infrastructure and registration details suggest potential for reemergence under a new name or IP. Organizations and users are advised to block the domain and its associated IP (84.32.84.229) at the network level. Cryptocurrency wallet users should verify all transaction requests independently and avoid interacting with unsolicited links or prompts. Security teams should monitor for similar domains registered through NICENIC INTERNATIONAL GROUP CO., LIMITED or resolving to the same IP range, as these may indicate related malicious activity.