# PhishDestroy domain threat record: xam-rpl.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/xam-rpl.com/
Machine-readable companion: https://phishdestroy.io/domain/xam-rpl.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-22 12:57:42 UTC
- Last availability or vendor check: 2026-10-22 13:01:43 UTC
- Stored record updated: 2026-10-22 16:30:30 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: Xaman
- Phishing kit: Airdrop Scam

## Stored infrastructure

- Observed IP address: 172.67.216.2
- Registrar in stored WHOIS data: Dynadot Inc
- Last stored HTTP status: 200
- Registration date (registry RDAP, xam-rpl.com): 2026-10-21 17:15:12 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a163b2-43ad-756b-b188-921cfd0ba9f9/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/xam-rpl.com
- Certificate Transparency search: https://crt.sh/?q=%25.xam-rpl.com
- Web Archive lookup: https://web.archive.org/web/*/https://xam-rpl.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s intake AI classified the site as malicious, noting that it claims an “XAM Airdrop” and references the Xaman brand while the domain does not belong to the official Xaman site. The page titled “XAM Airdrop: Check If Your Allocation Is Waiting | Xaman” was first observed by PhishDestroy on 2026-10-22, one day after the domain was registered on 2026-10-21, and returned an HTTP 200 response at that time.

How the scam works
In typical crypto‑airdrop phishing, attackers publish a counterfeit landing page that promises free tokens and urges visitors to connect a cryptocurrency wallet or disclose private keys. When a victim authorizes the request, the attacker can drain the wallet or harvest the credentials for later theft.

Evidence
URLScan captured the site on 2026-10-22 and assigned a malicious verdict with a score of 100, categorising it as phishing and tagging it as generic‑crypto. VirusTotal scanned the domain on 2026-10-22 with 92 engines and reported zero malicious or suspicious detections. Google Safe Browsing checked the URL on 2026-10-22 and did not flag it; external blocklists MetaMask and SEAL listed the domain (2 listings) and PhishDestroy’s internal blocklist also contains it as of 2026-10-22; OTX showed no pulses.

Infrastructure
The domain was registered with Dynadot Inc on 2026-10-21 and resolves to Cloudflare IP addresses 172.67.216.2 and 104.21.78.41, recorded as located in the United States. TLS was provided by Let’s Encrypt, valid from 2026-10-21 to 2027-01-19, and the site presented an HSTS header and Cloudflare’s web‑application firewall.

What to do
Users should avoid clicking any “Connect wallet” button or entering seed phrases on this site; if credentials were entered, treat them as compromised and secure the associated accounts. Organizations can block xam-rpl.com at the DNS or proxy level and monitor outbound traffic to the recorded IPs, citing the URLScan and Cloudflare Radar snapshots as evidence if credential exposure is suspected.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a163b2-43ad-756b-b188-921cfd0ba9f9/
Cloudflare Radar report: https://radar.cloudflare.com/scan/c8b0c014-3eeb-42b5-a125-ca26dad3c9b8
URLQuery report: https://urlquery.net/report/ea35bf1a-b147-439a-ab37-9f3255dacc6e
Stored capture screenshot: https://i.ibb.co/Q3QgwVTK/00dec95c66f6.png
Cloudflare Radar screenshot (2026-10-22T12:58:23Z): https://screenshots.phishdestroy.io/cf/c8b0c014-3eeb-42b5-a125-ca26dad3c9b8.png
URLScan screenshot (2026-10-22T11:23:00Z): https://screenshots.phishdestroy.io/us/01a16359-7e7e-77fc-bacc-0f2b4ce72b7f.png
URLScan capture report: https://urlscan.io/result/01a16359-7e7e-77fc-bacc-0f2b4ce72b7f/
URLScan screenshot (2026-10-22T13:04:16Z): https://screenshots.phishdestroy.io/us/01a163b6-33e0-70cc-8ee0-745b5f4bc91a.png
URLScan capture report: https://urlscan.io/result/01a163b6-33e0-70cc-8ee0-745b5f4bc91a/
VirusTotal report: https://www.virustotal.com/gui/domain/xam-rpl.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=xam-rpl.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-22 13:34:00 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/Q3QgwVTK/00dec95c66f6.png
  Captured: 2026-10-22 13:01:43 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a163b2-43ad-756b-b188-921cfd0ba9f9.png
  Captured: 2026-10-22 13:01:43 UTC
  Source report: https://urlscan.io/result/01a163b2-43ad-756b-b188-921cfd0ba9f9/
- URLScan capture 2: https://urlscan.io/screenshots/01a16359-7e7e-77fc-bacc-0f2b4ce72b7f.png
  Captured: 2026-10-22 12:57:42 UTC
  Source report: https://urlscan.io/result/01a163b2-43ad-756b-b188-921cfd0ba9f9/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/c8b0c014-3eeb-42b5-a125-ca26dad3c9b8.png
  Captured: 2026-10-22 12:58:23 UTC
  Source report: https://radar.cloudflare.com/scan/c8b0c014-3eeb-42b5-a125-ca26dad3c9b8
  SHA-256: 0242bc60a85e5dea6414c4a3372dfec73ad1ab01593ac19a1d775d9aba70add6

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-22T13:03:33Z",
        "uuid": "01a163b2-43ad-756b-b188-921cfd0ba9f9",
        "scanned_at": "2026-10-22T12:59:59Z",
        "final_url": "https://xam-rpl.com/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://xam-rpl.com/",
                "from": "http://xam-rpl.com/",
                "status": 307
            }
        ],
        "ip": "172.67.216.2",
        "domains": [
            "xrpl-scaner.com",
            "crossmark.io",
            "play-lh.googleusercontent.com",
            "pbs.twimg.com",
            "api.ipify.org",
            "static.cloudflareinsights.com"
        ],
        "ips": [
            "172.67.162.171",
            "76.76.21.21",
            "142.250.195.246",
            "199.232.136.159",
            "172.67.74.152",
            "104.16.79.73",
            "172.67.216.2"
        ],
        "asns": [
            "13335",
            "16509",
            "15169",
            "54113"
        ],
        "countries": [
            "US",
            "AU"
        ],
        "link_domains": [
            "help.xaman.app"
        ],
        "doc_hash": "fb78e58e38d6b39842de8af803ea2d65e9b63aa2d1045d86bc268f70c008389c",
        "script_hashes": [
            "c5d140c542dd219f6855ec7784b24f4174e60dc2b408a70fac7ab7280b8ef696"
        ],
        "globals": [
            "_0x5cb3",
            "_0x8696",
            "_0x4f32fa",
            "__ledgerLogsListen",
            "XRPLWalletConnect",
            "savepage_ShadowLoader",
            "__cfBeacon",
            "__xamanSeedP"
        ],
        "tls": {
            "san": [
                "*.xam-rpl.com",
                "xam-rpl.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "xam-rpl.com",
            "protocol": "QUIC",
            "valid_to": "2027-01-19T16:21:49Z",
            "valid_from": "2026-10-21T16:21:50Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 0,
        "tls_valid_days": 89,
        "requests": 16,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "genericcrypto"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Generic Crypto"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html",
            "strict-transport-security": "max-age=63072000; includeSubDomains; preload",
            "content-security-policy": "frame-ancestors http: https:",
            "x-content-type-options": "nosniff"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-22T13:00:56Z",
        "uuid": "c8b0c014-3eeb-42b5-a125-ca26dad3c9b8",
        "scanned_at": "2026-10-22T12:58:23Z",
        "final_url": "https://xam-rpl.com/",
        "status": 200,
        "history": [
            {
                "url": "https://xam-rpl.com/",
                "status": 200
            }
        ],
        "dom_hash": "1ad1b3bbbcc05819b7118ca2bab7aa73a26f0b1511b6d51d648eb3aeef33c8d5",
        "doc_hash": "253bd4015fab9185039c2612ef24dbf5b0f5b1833f304926f1ca7ceab7212fc0",
        "phishing_v2": [
            "phishing"
        ],
        "url_risks": [
            "Phishing"
        ],
        "domain_risks": [
            "Phishing",
            "Security threats",
            "Newly Seen Domains",
            "Security Risks",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "xam-rpl.com",
                "type": "A",
                "value": "104.21.78.41"
            },
            {
                "name": "xam-rpl.com",
                "type": "A",
                "value": "172.67.216.2"
            },
            {
                "name": "xam-rpl.com",
                "type": "AAAA",
                "value": "2606:4700:3034::ac43:d802"
            },
            {
                "name": "xam-rpl.com",
                "type": "AAAA",
                "value": "2606:4700:3030::6815:4e29"
            }
        ],
        "dnssec_valid": false,
        "ip": "104.21.78.41",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-10-21T17:15:12Z",
            "updated": "2026-10-21T17:16:02Z",
            "expires": "2027-10-21T17:15:12Z",
            "nameservers": [
                "mona.ns.cloudflare.com",
                "oswald.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T13:30:58Z",
        "analysis_at": "2026-10-22T13:11:39Z",
        "stats": {
            "timeout": 0,
            "harmless": 55,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 37
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "registrar": "Dynadot Inc",
        "created": "2026-10-21T17:15:12Z",
        "expires": "2027-10-21T17:15:12Z",
        "updated": "2026-10-21T17:16:02Z",
        "first_seen": "2026-10-21T17:30:44Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "oswald.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "mona.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3034::ac43:d802"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "mona.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.216.2"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.78.41"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3030::6815:4e29"
            }
        ],
        "dns_at": "2026-10-22T13:12:01Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.xam-rpl.com",
                "xam-rpl.com"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "6187f73f2d5221f8f75099b551b9c4a8862",
            "sha256": "4011628306ee14dca25633ae608c7f1c91543c8038cbd93bcc391fd875e32f86",
            "subject": "xam-rpl.com",
            "valid_to": "2027-01-19T16:21:49Z",
            "valid_from": "2026-10-21T16:21:50Z"
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "registrar_iana_id": "472",
            "registrar_url": "http://www.dynadot.com",
            "created": "2026-10-21T17:15:12Z",
            "updated": "2026-10-21T17:16:02Z",
            "expires": "2027-10-21T17:15:12Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "mona.ns.cloudflare.com",
                "oswald.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-10-21T17:15:12Z",
                "last changed": "2026-10-21T17:16:02Z",
                "registration": "2026-10-21T17:15:12Z",
                "last update of RDAP database": "2026-10-21T17:30:20Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-22T13:01:18Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "xam-rpl.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-22T12:58:50Z",
            "first": "2026-10-22T12:58:50Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 131926
        },
        "social_tags": {
            "title": "XAM Airdrop: Check If Your Allocation Is Waiting | Xaman",
            "themeColor": "#ffffff",
            "description": "250,000,000 XAM is being distributed to early Xaman users. Allocations are already reserved on-chain. Connect your wallet to see if yours is waiting before the claim window closes."
        },
        "trackers": {
            "requests": 7,
            "trackers": [
                {
                    "name": "Google User Content",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "ipify",
                    "company": "ipify",
                    "category": "Misc",
                    "requests": 1
                },
                {
                    "name": "X Corp.",
                    "company": "X Corp.",
                    "country": "US",
                    "category": "Social Media",
                    "requests": 1
                }
            ]
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 1,
                "tls": 24,
                "wait": 177,
                "connect": 9,
                "download": 13
            },
            "response_ms": 224
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 198506,
            "co2_grams": 0.0073,
            "cleaner_than": 7
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "108.162.192.206",
                    "host": "mona.ns.cloudflare.com"
                },
                {
                    "ip": "173.245.59.218",
                    "host": "oswald.ns.cloudflare.com"
                }
            ],
            "zone": "xam-rpl.com"
        },
        "location": {
            "ip": "2606:4700:3030::6815:4e29",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "San Francisco",
            "country": "US"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE1",
            "subject": "xam-rpl.com"
        },
        "dns": {
            "A": [
                "104.21.78.41",
                "172.67.216.2"
            ],
            "NS": [
                "mona.ns.cloudflare.com",
                "oswald.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"mona.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418112811, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2606:4700:3030::6815:4e29",
                "2606:4700:3034::ac43:d802"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "header": "max-age=63072000; includeSubDomains; preload",
            "message": "Site is compatible with the HSTS preload list!",
            "compatible": true
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": "1; mode=block",
            "permissionsPolicy": false,
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": "frame-ancestors http: https:",
            "strictTransportPolicy": "max-age=63072000; includeSubDomains; preload",
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2606:4700:3034::ac43:d802",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://xam-rpl.com"
            ]
        },
        "tech_stack": {
            "technologies": [
                "HSTS",
                "Cloudflare",
                "HTTP/3"
            ]
        },
        "linked_pages": {
            "external": [
                "https://help.xaman.app/app"
            ],
            "external_count": 1,
            "internal_count": 1
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-10-21T17:15:12Z",
            "updated": "2026-10-21T17:16:02Z",
            "expires": "2027-10-21T17:15:12Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "mona.ns.cloudflare.com",
                "oswald.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html",
                "strict-transport-security": "max-age=63072000; includeSubDomains; preload",
                "content-security-policy": "frame-ancestors http: https:",
                "x-content-type-options": "nosniff"
            }
        }
    }
}
```