xamandesktops[.]app

This domain, xamandesktops.app, operates as a brand impersonation threat targeting users of the Xaman self-custody wallet for the XRP Ledger (XRPL). Analysis indicates the site mimics the legitimate Xaman wallet interface, presenting itself as "Xaman Desktop - The Leading Self-Custody Wallet for XRPL." Such impersonation schemes typically aim to deceive users into entering sensitive credentials, seed phrases, or private keys, which threat actors can exploit to drain cryptocurrency assets from victim wallets. The presence of wallet-related branding and claims of self-custody functionality heighten the risk of financial loss for unsuspecting users. Technical indicators confirm the domain's malicious intent. VirusTotal analysis shows 3 out of 95 security vendors have flagged xamandesktops.app as malicious. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. It currently appears on two security blocklists, including PhishDestroy and OISD, and resolves to the IP address 216.198.79.1. The SSL certificate is issued by Let's Encrypt, a common tactic to lend superficial legitimacy to fraudulent sites. Detected technologies include Vercel for hosting, LiveChat for potential social engineering, and HSTS, which may be used to evade certain security warnings. Users who visited xamandesktops.app should take immediate action to mitigate potential compromise. Disconnect any wallets or devices that interacted with the site and revoke any connected dApp permissions. Scan the device for malware using reputable security tools, as threat actors may have deployed additional payloads. If credentials or seed phrases were entered, transfer assets to a new wallet with a fresh seed phrase, as the existing wallet is considered compromised. Monitor transaction histories for unauthorized activity and report the incident to relevant security communities or the legitimate Xaman team for further guidance.