xamandesktop[.]io

Analysis as of July 24, 2026 indicates that xamandesktop.io was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is currently active. DNS resolution points to 216.150.1.1, an Amazon Web Services address (AS16509) located in the United States. The domain is served behind Cloudflare nameservers (jessica.ns.cloudflare.com, chuck.ns.cloudflare.com) and delivers HTTP 307 redirects, suggesting intentional traffic forwarding. The site presents a TLS certificate issued by Let’s Encrypt (R12) and advertises HSTS, yet the Gridinsoft trust score is 0/100, reflecting a lack of reputation.

Automated fingerprinting identified Vercel and LiveChat components, common to many legitimate web applications but also frequently abused in fraudulent deployments. The page title “Xaman – The Best XRP Wallet for Security” directly references the Xaman brand, confirming a brand‑impersonation motive aimed at cryptocurrency users. VirusTotal analysis shows that 3 of 93 security engines flag the domain, and it is listed on three external blocklists, including PhishDestroy, MetaMask, and SEAL, reinforcing its malicious classification as a crypto scam.

While the exact phishing mechanics have not been publicly disclosed, the convergence of brand‑targeted naming, low trust score, redirection behavior, and multiple vendor detections provides strong evidence of an active malicious infrastructure. Defenders should block the domain and its resolving IP at DNS and proxy layers, monitor outbound connections to the AWS address, enforce strict TLS validation, and update endpoint protection signatures to include the reported indicators. User awareness campaigns should emphasize that any unsolicited request promising Xaman wallet services, especially those directing to this domain, is likely fraudulent.