Evidence verified October 26, 2026

Name-collision domains are shadowing the Xeno wallet name

This is a public evidence page from Scam Detective’s published research — and an honestly framed one. The real Xeno (the stablecoin-payments company behind the Xeno Wallet app) operates at xeno.money and distributes its wallet through the official app stores. The two domains below are name-collision lookalikes: wallet-branded sites on a weeks-old, hidden-identity domain that compete for searches on the brand’s name. On the current evidence this is a documented search-visibility and brand-confusion risk — not a proven deliberate impersonation — and this page characterizes it that way deliberately. Every finding below is backed by the independent sources listed further down.

2
Lookalike domains found
High
Overall risk level
3
Independent corroborating sources
October 26, 2026
Case verified
The evidence

Confirmed lookalike domains

High riskName-collision lookalike — “Xenos Wallets” domain

xenoswallets.com

Registration profileRegistered July 10, 2026 via Spaceship, with the registrant’s identity hidden behind WHOIS privacy
First seenLive at verification (October 2026)
Evidence
  • Live at verification and served from a bare IP address (209.74.68.30) rather than the CDN infrastructure an established payments company uses — a one-host operation, not an institutional deployment.
  • Independently scored 1/100 by ScamAdviser — the lowest rating band, “Very Likely Unsafe.”
  • Registered July 10, 2026 via Spaceship with the registrant hidden behind WHOIS privacy — while the real Xeno (xeno.money) distributes its wallet through the official Google Play and App Store listings. Weeks-to-months of age shadowing an established name.
  • Characterized honestly: the resemblance to the Xeno name is a collision and search-visibility risk, not — on the current evidence — a proven deliberate impersonation of the brand. The evidence does not establish intent, and this page does not claim it.
High riskApp-serving subdomain of the same name-collision domain

app.xenoswallets.com

Registration profileA subdomain of xenoswallets.com — created on the same weeks-old, hidden-identity parent; subdomains leave no independent registration trail of their own
First seenLive at verification (October 2026)
Evidence
  • The wallet-app-serving path on the same bare-IP host (209.74.68.30) — an “app” subdomain is what a wallet-brand impersonation needs, because a wallet download is the highest-value action a visitor can be steered into.
  • The app-store naming convention (“app.”) reads as an official deployment of a wallet brand; the real Xeno Wallet is distributed through xeno.money and the official app stores, nowhere else.
  • Same honest framing as its parent domain: this is brand confusion in the wallet-app search path — a search-visibility risk — not proven deliberate impersonation.
The pattern

Red flags in this name-collision case

  1. 01A wallet-branded domain close to the brand’s name competing for “Xeno wallet” searches — before downloading anything or entering a seed phrase, verify the domain against xeno.money. A wallet download from an unverified domain is the highest-stakes action in this entire case.
  2. 02Lowest-band third-party risk score — ScamAdviser rates xenoswallets.com 1/100, “Very Likely Unsafe.”
  3. 03Weeks-old, WHOIS-hidden registration — registered July 10, 2026 via Spaceship, with the registrant’s identity hidden.
  4. 04Served from a bare IP address (209.74.68.30) rather than the CDN infrastructure an established payments company uses.
  5. 05No affiliation verifiable anywhere on the brand’s own properties — the real Xeno Wallet is distributed through xeno.money and the official app stores, nowhere else.
  6. 06Honest framing matters here: the evidence supports a name-collision and search-visibility risk; it does not establish deliberate impersonation. Either way, the remedy is the same — know which domains are actually yours, and which ones surface next to your brand’s name.
Independent confirmation

Who corroborates this evidence

ScamAdviser public rating

ScamAdviser independently scores xenoswallets.com 1/100 — “Very Likely Unsafe,” its lowest rating band. A third-party risk rating of the domain itself, corroborating that the site is unsafe regardless of the impersonation question.

WHOIS registration record

The registration record shows July 10, 2026 via Spaceship with the registrant’s identity hidden — a weeks-old, anonymous registration trading on an established wallet name.

Brand-domain mismatch

The real Xeno operates at xeno.money and distributes the Xeno Wallet through the official app stores; xenoswallets.com and its app subdomain have no connection to the company — though the evidence establishes collision and confusion, not deliberate intent.

Full investigative write-up: Fake Bitcoin Wallet App Scam: How Scammers Steal Your Crypto Through Fake Apps.

See exactly what you get

The audit, opened up

Findings · Risk ratings · Takedown template

Below is an abbreviated sample from a real audit format — the same report structure every $29 audit follows. The brand and domains shown are an illustrative example; your audit researches the company name and official domain you enter and documents what it finds the same way.

Sample — from a real audit format
Report date: March 14
Brand impersonation audit
Harborline Supply Co.
Official domain: harborlinesupply.com · 6 findings (5 shown) · 2 High · 2 Medium · 1 Low
Findings — lookalike domains
DomainTypeRiskEvidence
harborline-supply.comFake storefrontHighFull copy of the official site — same logo placement, layout, and product photography. Checkout collects card details before account creation. Registered 9 days ago behind a privacy proxy.
harborl1nesupply.comTyposquatHighDigit-for-letter swap ("1" for "l"). Redirect chain lands on a replica storefront with a cloned login form. SSL certificate issued 4 days after registration.
harborlinesupply-outlet.shopFake outletMediumPoses as a discount outlet channel. No affiliation disclosed anywhere on the site; the footer copies Harborline's legal text verbatim.
getharborlinesupply.comLookalikeMediumRoutes brand-name search traffic to a survey-with-prize flow before offering any products. Registered in the same bulk batch as the fake storefront above.
harborlinesupply.shopLookalikeLowBrand-name domain, currently parked with no active checkout. Rated Low and flagged for a re-check in 30 days in case it activates.

+ 1 more finding in the full report, documented the same way. Report summary: active impersonation campaign — act on the two High-risk domains first.

Takedown-request template — excerpt
Subject: Takedown request — <lookalike-domain> To the Abuse Team at <registrar / hosting provider>, I am writing on behalf of Harborline Supply Co., owner of the trademark HARBORLINE SUPPLY and the official website harborlinesupply.com. The domain <lookalike-domain>, registered through your service on <registration date>, impersonates our brand to deceive our customers: 1. Copies our logo, site layout, and product photography 2. Operates a checkout that collects visitors' card details 3. Discloses no affiliation with our company We request the immediate suspension of <lookalike-domain> …

The full template ships pre-filled with your brand, your official domain, and each finding's evidence — one per high-risk domain, ready to send to its registrar or host.

Your $29 audit follows this exact format for your company — every lookalike, typosquat, and copycat store found, each with its evidence and risk rating, plus the takedown template. Delivered instantly after checkout.

One-time payment

We found this without being asked

A brand impersonation audit does the same sweep for your company: every lookalike domain, typosquat, and copycat store impersonating your brand — each with evidence and a risk rating, plus a ready-to-send takedown-request template. Delivered instantly, $29 one-time, no subscription.

Audit my brand — $29
Questions about this evidence, or need it for a takedown request? Email [email protected].
Not ready to buy?

Get the free Xeno impersonation evidence pack

Every confirmed lookalike domain, the red-flag pattern, and the independent corroboration from this page — compiled into one file and emailed to you, free. Useful for your security or legal team even if you never buy anything from us.

Ready now? The brand impersonation audit sweeps your own company for every lookalike domain, typosquat, and copycat store — with evidence, risk ratings, and a takedown-request template. $29 one-time, delivered instantly, no subscription.

Other brand evidence pages
Corkcicle →StoneX →Fidelity →Owala →BrüMate →MrBeast →USPS →LEGO →AMLBot →Amazon →Huawei →Daniel Wellington →SodaStream →CurrentBody →Dreame →Grubhub →TikTok Shop →Ooni →Simple Modern →Vessi →Swig Life →Barefoot Dreams →Midsummer Agency →Grow & Convert →Wordibly →Labrys →Arctoris →Staffology by IRIS →KeenLogic →Dotinum →Vosyn →OpenSea →Merkle →THE OUTNET →Jelurida →All evidence pages