Is xaman-platform.app a scam? TrustSniffer's high-risk assessment: 19/100

Security Alert

Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a single-page landing site on a ".app" domain that presents itself under the "Xaman" name. Its homepage carries the title "Cold Storage in Your Pocket" and appears to promote a mobile self-custody cryptocurrency wallet. The captured homepage holds only a small amount of text. It shows no company name, product documentation, or business detail beyond the wallet pitch. Its apparent purpose is to attract visitors to a wallet-style product, which is a category where users are normally asked for credentials, recovery phrases, or transaction approvals.

Scam/Impersonation Risk

Contradictory signals are present and decisive. Several independent threat-intelligence engines currently flag the domain as malicious, including one tier-one security vendor, and the external reputation sources confirm it as blacklisted. A brand-style wallet title on a domain registered only days earlier is the pattern typically seen when a lookalike site is staged to harvest wallet credentials. No evidence in hand ties the site to any real-world brand or operator. Two things are not asserted: that a specific brand is being impersonated, and that conflicting legal identities exist. The site shows no competing entity names. The danger comes from the combination of confirmed malicious flags and a brand-evoking, high-value-asset pitch with no verifiable owner. A site of this kind that asks for a recovery phrase, wallet connection, or login can cause irreversible loss, because cryptocurrency transfers cannot be reversed. Evidence:

• Homepage: the page title presents a "Cold Storage in Your Pocket" wallet pitch under the Xaman name, with no accompanying corporate identification.
• Domain provenance: registered 2026-10-13 (about 8 days old, roughly 0.02 years), giving the site essentially no operating track record.
• Web-archive depth: 3 archive snapshots spanning 2026-10-14 to 2026-10-15 (1 year tracked), with no earlier history of any benign use.
• Reputation: two engines rate the domain malicious, one of them a tier-one vendor, and an external blacklist entry is confirmed.

Regulatory Verification Notes

The site gives no verifiable legal entity, licence, or registration number, and the ownership trail is opaque. Because the site makes a custody-of-funds claim, this matters more than it would for an ordinary brochure site. No third-party broker or regulatory-database record matches the domain, so there is no external reputational context either way. The domain was registered through the corporate registrar Key-Systems LLC, which is an administrative fact and does not vouch for the operator. The transport encryption is valid, but it only shows that the connection is encrypted, not who runs the site. Evidence:

• Homepage: no operator name, regulator reference, or licence statement appears in the captured content.
• Registrar: Key-Systems LLC; registration runs to 2027-10-13, a one-year term.
• Transport encryption: TLS certificate issued by WE1 (domain-validated, DV), valid to 2027-01-11 with about 81 days remaining. Domain validation confirms control of the domain only.
• Third-party coverage: no broker-review or regulatory-database match was found for this domain.

What to Verify Next

The site's connection to any brand should be tested independently, never through links or contact details on the site itself. Anyone who believes they are dealing with a legitimate wallet provider should reach that provider through a channel obtained offline or from an established source, and confirm that this exact domain is listed as an official property. Official channels should also be asked whether they operate a wallet-related site under this name. Anyone who has already entered credentials, a recovery phrase, or wallet approvals should treat those assets as exposed. In that case they should move remaining funds to a newly created wallet and revoke any wallet permissions that were granted. Evidence:

• Homepage: the brand-style title is the only identity claim, so it must be validated externally rather than on-site.
• Domain age: the site is only days old, so no established history can confirm who operates it.
• Behavioral testing of the homepage showed no wallet-connection prompts, clipboard tampering, hidden forms, or content cloaking. These checks cover the captured visit only and do not clear the site, given the confirmed malicious ratings.
• The page makes substantial outbound data submissions to external destinations, all of them to recognised services, which is a minor observation rather than a finding.

Summary Verdict

The overall posture is high risk. Confirmed malicious ratings from independent sources, combined with a very recent registration and no attributable operator, outweigh the technical hygiene the site shows. Legitimacy is not supported, and the site should be treated as a credible credential-theft or wallet-drain candidate until independent evidence shows otherwise.

Infrastructure Integrity

The site is served from Cloudflare (AS13335, US) behind its CDN and WAF. All four observed addresses are edge servers, and the origin server was not observable. This infrastructure is common and well managed, and it mitigates exposure to disruption. It cannot offset the confirmed malicious ratings, and it does not show who operates the site, because edge-only visibility prevents independent verification of the hosting and can mask rapid content swaps.

Closing Assessment

Interaction beyond passive viewing is not advisable. That means no logging in, no entering or importing a recovery phrase, no connecting a wallet, no approving transactions, and no payments. Anyone who needs this brand's services should use only an independently confirmed official address.