xamanwallet[.]money

The domain xamanwallet.money is a brand impersonation threat targeting the Xaman wallet platform. Currently offline, this domain was designed to deceive users into believing it was the legitimate Xaman service, likely to steal cryptocurrency credentials or drain wallets. The page title "Cold Storage in Your Pocket | Xaman" closely mimics the real Xaman branding, increasing its deceptive potential.

PhishDestroy's analysis reveals that xamanwallet.money was flagged by 1 out of 95 security vendors on VirusTotal, indicating limited but confirmed detection. The domain was created on May 12, 2026, through the registrar NICENIC INTERNATIONAL GROUP CO., LIMITED, and resolves to the IP address 104.21.49.92. It appears on 3 security blocklists and is referenced in 1 AlienVault OTX threat intelligence pulse. The domain uses a Let's Encrypt SSL certificate (E7), which is common among both legitimate and malicious sites, so it should not be considered a sign of safety.

Given its elevated risk level and confirmed impersonation of Xaman, users should avoid any interaction with this domain. Although currently offline, it could be reactivated. PhishDestroy recommends verifying all wallet-related URLs directly from official sources and never entering sensitive information on unverified sites. Always double-check domain names for subtle typos or variations, and use trusted security tools to assess unknown links. If you have already visited this site, change your wallet credentials immediately and monitor for unauthorized transactions.