xamanvoting[.]com

xamanvoting.com entered the PhishDestroy evidence set on Aug 7, 2026. Stored content metadata identifies Ledger as the apparent target. The stored content classification is seed phrase theft. The assembled evidence scores 88/100 (high).

Two independent sources are positive: VirusTotal and URLQuery. VirusTotal recorded 11 detections among 91 engines: alphaMountain.ai, BitDefender, CRDF, CyRadar, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Kaspersky, Lionic, Sophos on Aug 7, 2026 at 10:44 UTC. URLQuery recorded 1 threat-system alert on Aug 7, 2026 at 10:46 UTC. The evidence is not unanimous. The external blocklist snapshot contained no matches on Aug 7, 2026 at 14:20 UTC. On Aug 7, 2026 at 10:44 UTC, Google Safe Browsing returned no flag; URLScan captured the page.

The collector marked the hostname reachable on Aug 7, 2026 at 10:44 UTC, but did not retain the HTTP response code. Registration records for the domain list PDR Ltd. d/b/a PublicDomainRegistry.com as the registrar and Jun 11, 2026 as the creation date. At collection time, the hostname resolved to 188.114.96.3 (AS13335 Cloudflare, Inc.). The recorded endpoint location is San Francisco, US. The stored server header is cloudflare. Captured page title: “Xaman — The Best Self-Custody Wallet for XRPL & Xahau”. DOM analysis completed on Aug 7, 2026 at 14:20 UTC; stored DOM score 0/100. The evidence archive retains 5 visual captures from PhishDestroy, URLScan, URLQuery, and Cloudflare Radar. TLS metadata lists Google Trust Services as the certificate issuer with validity through Sep 9, 2026; checked Aug 7, 2026 at 13:02 UTC.

The 0/100 DOM score means that the DOM pass stored no scored indicators; it does not negate the independent source findings. Taken together, the page content and independent findings support classifying this hostname as Ledger-themed seed phrase theft.