xaman[.]group

Analysis of the domain xaman.group, registered on February 22, 2026, indicates active brand impersonation targeting Xaman, a cryptocurrency wallet provider. The domain's page title, 'Xaman Wallet™ — The Best XRP Wallet for Security & Control,' directly mimics the branding of the legitimate Xaman service, aligning with the reported scam type of a crypto scam. As of July 24, 2026, the domain remains active, returning an HTTP 200 status, and is hosted on Cloudflare infrastructure, resolving to the IP address 104.21.63.132 (AS13335, United States). The domain is protected by Cloudflare nameservers (mary.ns.cloudflare.com and damien.ns.cloudflare.com) and uses an SSL certificate issued by Google Trust Services (WE1).

Detection data reveals limited but notable coverage: two of 95 security vendors on VirusTotal flag the domain as malicious, and it appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. The registrar, NiceNIC International Group Co., Limited, provides no additional contextual indicators of compromise. Infrastructure analysis shows the use of HTTP/3, a protocol often leveraged for performance but also observed in malicious campaigns due to its ability to evade traditional detection mechanisms.

While the domain's exact content and functionality have not been fully analyzed, the combination of brand impersonation, crypto-themed scam classification, and blocklist presence confirms a high-risk designation. Defenders are advised to block the domain at the DNS or proxy level, monitor for connections to 104.21.63.132, and alert users to the impersonation of Xaman Wallet. Additional scrutiny of Cloudflare-hosted domains with recent registration dates and crypto-related page titles may help identify related threats.