en-xaman[.]top

Analysis of en-xaman.top, observed as offline as of July 24 2026, shows that the domain was registered on March 11 2026 through 耐思尼克国际集团有限公司 and resolves to the Cloudflare address 172.67.206.34, belonging to AS13335 (Cloudflare, Inc.) in the United States. The authoritative nameservers are dana.ns.cloudflare.com. and grant.ns.cloudflare.com., confirming use of Cloudflare DNS infrastructure. The site presented a page whose title reads “Xaman – The Ultimate XRP Wallet® for Secure & Easy Management”, explicitly positioning itself as a Ledger‑related service, which aligns with the identified brand‑impersonation tactic targeting Ledger users. No TLS certificate was offered, meaning the site operated without HTTPS encryption.

Detection services have flagged the domain: four of ninety‑four VirusTotal scanners raised alerts, and AlienVault OTX references the domain in a single threat pulse. The domain appears on three external blocklists and has been blocked by PhishDestroy, MetaMask, and SEAL, while Gridinsoft assigns a trust score of zero out of one hundred. The current offline status indicates the operators have withdrawn the site, but the underlying Cloudflare IP and nameserver configuration remain reusable for future campaigns. Defenders should continue to block en-xaman.top at DNS and proxy layers, monitor the hosting IP 172.67.206.34 for any resurgence, and add the associated nameservers to deny lists.

Because the domain lacks an SSL certificate, any attempt to serve content over HTTPS will fail, providing an additional mitigation point. Security appliances that reference VirusTotal, AlienVault OTX, or the reported blocklists should be updated to reflect the four VirusTotal detections and the single OTX pulse. Organizations enforcing Ledger credential protection should educate users about the fraudulent “Xaman” branding and restrict access to untrusted cryptocurrency wallet URLs.