xaman[.]chat

This domain, xaman.chat, poses a direct threat to users of the Xaman Wallet by impersonating its official desktop and extension interfaces. The site presents itself as a secure platform for XRP transactions under the title 'Xaman Wallet - Secure Desktop & Extension for XRP,' aiming to deceive users into entering sensitive credentials, such as wallet recovery phrases or private keys. Such brand impersonation attacks are designed to exploit trust in legitimate services, often leading to unauthorized access and financial loss for victims. Analysis indicates that xaman.chat was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar often associated with suspicious domains. The domain is flagged by 6 out of 95 security vendors on VirusTotal, including detection by PhishDestroy. Infrastructure analysis reveals the site resolved to the IP address 172.67.191.221 and utilized Cloudflare for hosting, along with HTTP/3 and an SSL certificate issued by Google Trust Services. These technical indicators suggest an attempt to appear legitimate while obscuring malicious intent. Users who visited xaman.chat should immediately cease all interaction with the site and assume any credentials entered have been compromised. It is critical to revoke access to any connected wallets or accounts and monitor for unauthorized transactions. If financial assets were transferred, report the incident to relevant authorities and the targeted brand’s official support channels. Additionally, scan local devices for malware, as phishing sites may deploy additional payloads. Always verify domain authenticity by cross-referencing official sources before entering sensitive information.