Is xaman-promo.xyz a scam? TrustSniffer's high-risk assessment: 5/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a single-page marketing site for "Xaman", presented as a self-custody wallet for the XRP Ledger and Xahau. Under the headline "Cold Storage in Your Pocket", it promotes transaction review, visible security and a swap function. Its main call to action is a "Check your allocation" button for an XRP ecosystem airdrop, supported by an in-page community fund vote that shows XP rewards. The page states no fees or monetization model. Its apparent purpose is to steer visitors toward an airdrop-claim flow under a well-known wallet brand.

Scam/Impersonation Risk

This assessment is clearly cautionary. Several established security vendors currently flag the domain as malicious, and a further engine rates it suspicious, so the site is blacklisted by external reputation sources. This is decisive and is not offset by the polished appearance of the page. The domain pairs the wallet brand with the word "promo" on a newly registered, low-cost top-level domain. That is a common pattern for lookalike campaign domains, although brand impersonation itself was not confirmed by page analysis. The airdrop call to action is the main risk surface: the homepage gives no eligibility criteria, token details or distribution terms, yet invites visitors to "check" a personal allocation. In the wallet context this typically leads to a wallet-connection or seed-entry step. The homepage's mock-up balance of "2,481.20 XRP" and its "+1,535 XRP" payment are illustrative figures that create an impression of real earnings. During behavioral testing the page sent several data submissions to non-whitelisted external destinations, and a high share of its network activity went to third-party hosts. This is unusual for a static landing page. No hidden forms, clipboard manipulation, wallet-drainer behavior or cloaking were observed, and no wallet-connection attempts occurred during testing. The risk therefore rests on external threat detections and context, not on a malicious mechanism the sandbox observed directly.

Regulatory Verification Notes

The homepage carries a support and legal footer, but it names no operating company, registered address, jurisdiction or responsible individual. No license or registration claim is made, so there is nothing on the page to check against a registry. Real-world operator identity remains unverified, and ownership is opaque. This is a verification gap, and it weighs more heavily here because the site asks visitors to engage with a token-distribution mechanic and also lacks any published terms for it. No third-party broker or regulator record matched this domain. That absence is not a clearance, since a newly registered domain would not yet appear in such sources.

What to Verify Next

Before any interaction, the domain should be compared against the wallet's officially published website and app-store listings, using an independent route such as the project's verified social accounts or a separately obtained bookmark. Any airdrop or allocation announcement should be confirmed through the project's official announcement channels, because a legitimate distribution would be documented there with its eligibility criteria. The official support and contact channels should be confirmed independently, not through links on this site. If the site has already been visited, browser history and any wallet approvals should be reviewed for unexpected connections or signature requests.

Summary Verdict

The overall posture is high-risk. Confirmed external threat detections override the otherwise professional presentation of the page, and the operator's real identity cannot be linked to the brand it displays. The site is suitable at most for passive viewing, and not for any action involving credentials, wallets or funds.

Infrastructure Integrity

The site is fronted by Cloudflare's CDN and WAF, and all observed addresses are edge servers, so the origin host is not visible. This protective layer is a mitigating factor only. It cannot offset the external reputation findings, and edge-only visibility prevents independent confirmation of where the content is hosted and makes rapid content changes harder to detect. The valid certificate and clean abuse history of the shared edge network describe Cloudflare's infrastructure, not the site's operator.

Closing Assessment

The site should be treated as unsafe for any login, wallet connection, seed-phrase entry, signature approval or financial interaction. Access should be limited to passive viewing, if at all. Anyone who has already connected a wallet or entered recovery details should move assets to a freshly generated wallet and revoke any approvals promptly.