xamansolo[.]com

The domain xamansolo.com was identified as a high-risk brand impersonation threat targeting users of the XRP Ledger (XRPL) ecosystem. Analysis confirms this domain facilitated an airdrop scam, specifically impersonating the Xaman wallet and Sologenic ($SOLO) token allocation program. The page title, 'Xaman × Sologenic — XRPL Ecosystem Airdrop · $SOLO LP Allocation,' directly mimics legitimate promotional campaigns to deceive victims into interacting with malicious smart contracts or disclosing private keys. The domain is currently offline, though prior activity remains a verified risk. Infrastructure analysis reveals xamansolo.com was registered on June 3, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with abuse complaints. The domain resolved to the IP address 188.114.97.3, a Cloudflare-protected endpoint, and was detected by 14 of 95 security vendors on VirusTotal. It appeared on four independent security blocklists and was actively blocked by multiple wallet security tools, including MetaMask’s built-in phishing detection and ScamSniffer’s transaction monitoring systems. Technologies detected on the domain included HTTP/3, HSTS, and Cloudflare Browser Insights, suggesting an attempt to mimic legitimate, high-security platforms. Given the domain’s current offline status, immediate interaction risks are reduced, though historical exposure remains a concern. Users who previously visited or engaged with this domain should revoke any connected wallet permissions, rotate private keys, and monitor accounts for unauthorized transactions. Organizations are advised to update blocklists with the domain and IP address (188.114.97.3) to prevent future access. Security teams should prioritize monitoring for similar impersonation attempts targeting XRPL or other blockchain ecosystems, particularly those leveraging Cloudflare-protected infrastructure and registrar patterns consistent with NICENIC INTERNATIONAL GROUP CO., LIMITED.