dao-xaman[.]app

The domain dao-xaman.app has been identified as a generic phishing threat, specifically a crypto drainer and brand impersonation site targeting Xaman (formerly Xumm) users. This malicious domain was designed to trick victims into believing they were interacting with the legitimate Xaman platform, a popular wallet for the XRP Ledger. The threat actors behind this operation likely deployed a drainer kit to steal cryptocurrency assets upon user interaction.

Technical indicators reveal that dao-xaman.app was created on May 29, 2026, and registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain resolves to IP address 188.114.97.3 and uses an SSL certificate issued by Let's Encrypt (identified as YE2). VirusTotal analysis shows that 3 out of 95 security vendors flagged this domain as malicious. Additionally, the domain appears on three security blocklists, and its current status is offline as it has been taken down.

As of now, dao-xaman.app is offline, indicating that response actions have been taken to mitigate the threat. However, users should remain vigilant as similar domains may reappear. It is strongly recommended to avoid interacting with any unsolicited communications referencing Xaman or crypto wallets without verifying the official domain. PhishDestroy advises users to enable two-factor authentication, use hardware wallets, and report any suspicious domains to security authorities.