xamandesktopwallet[.]app

Analysis of xamandesktopwallet.app as of 23 July 2026 shows a brand‑impersonation infrastructure targeting the Xaman cryptocurrency wallet brand. The domain was hosted on Amazon AWS under ASN 16509 and resolved to 64.29.17.1, a US‑based address. DNS resolution used Vercel‑provided nameservers ns1.vercel-dns.com and ns2.vercel-dns.com, and the registrar entry lists Vercel Inc. as the sponsoring registrar. An HTTPS endpoint was secured with a Let’s Encrypt R12 certificate, and the server advertised HTTP Strict Transport Security (HSTS). The web server returned HTTP status code 451, indicating legal restrictions, and the page title captured by crawlers reads “Xaman Wallet Desktop – The Leading Self‑Custody Wallet To Claim Glacier Drop For XRPL”, directly referencing the Xaman brand and a fictitious “Glacier Drop” promotion.

Threat intelligence sources have flagged the domain in one AlienVault OTX pulse and it appears on two public blocklists. Both PhishDestroy and ScamSniffer have added the domain to their block lists, confirming its classification as a crypto‑related scam. VirusTotal scanned the site and 12 of 95 security vendors reported malicious activity, reinforcing the suspicion of malicious intent. The combination of brand‑impersonating page title, crypto‑scam label, and multiple vendor detections indicates a coordinated attempt to lure Xaman users into a fraudulent wallet download or credential harvest. Current observations show the domain is taken offline, which may be a temporary takedown or a shift to another hosting location.

No further content has been captured, and the exact payload or credential‑capture mechanism remains unknown. Defenders should continue to monitor DNS queries for the IP address 64.29.17.1 and the Vercel nameservers, update endpoint protection to block the domain, and add the associated hash of the SSL certificate to block lists.