xamanwallet-xapp[.]com

The domain xamanwallet-xapp.com is currently active and has been identified as a crypto‑drainer infrastructure. HTTP requests return a 403 status code and the only observable page title is "Just a moment...", indicating that the content has not been publicly disclosed. The domain is listed on three security blocklists and has been blocked by PhishDestroy, MetaMask, and SEAL. It appears in two AlienVault OTX threat‑intel pulses, reinforcing its association with malicious activity. Technical infrastructure shows the domain resolves to IP 188.114.96.3, which is hosted by CloudFlare, Inc. in Canada. Nameservers are kara.ns.cloudflare.com and rob.ns.cloudflare.com, and the SSL certificate is issued by Google Trust Services under the WE1 designation. VirusTotal analysis shows five of ninety‑one security vendors flag the domain, providing additional confirmation of its malicious nature. Registration was performed through NICENIC INTERNATIONAL GROUP CO., LIMITED, but no further registrant details are disclosed. The exact payload or attack vector has not been observed; only the crypto‑drainer classification is known from the provided intelligence. Defenders should immediately block DNS resolution for xamanwallet-xapp.com, add the associated IP address to firewall deny lists, and ensure that any endpoint clients using MetaMask or similar wallet extensions are configured to reject connections to this domain. Continuous monitoring of CloudFlare‑hosted IP ranges for similar activity and periodic re‑query of threat‑intel feeds for new indicators are recommended to mitigate potential spillover.