xamanxrpclaim[.]com

Analysis as of August 02, 2026 indicates that the domain xamanxrpclaim.com is actively used in a cryptocurrency draining campaign. The site appears on a single security blocklist and is explicitly blocked by the PhishDestroy mitigation service, confirming that it has been identified as malicious by at least one reputable anti‑phishing feed. VirusTotal reports that seven out of ninety‑one scanned scanners flagged the domain, demonstrating a moderate level of detection across independent engines.

The presence of multiple detections, combined with the blocklist entry, suggests that the infrastructure is being actively leveraged to solicit cryptocurrency payments under false pretenses. The exact content served by the site has not been publicly disclosed; no page title, SSL certificate details, or hosting information are available in the current intelligence set, leaving those aspects of the infrastructure unverified. Nevertheless, the convergence of blocklist inclusion, active blocking by PhishDestroy, and multi‑engine detection provides sufficient confidence to classify the domain as a confirmed crypto drainer.

Defenders should add xamanxrpclaim.com to local deny lists, enforce outbound filtering to block connections to the domain, and monitor network logs for any attempted DNS resolution or HTTP requests to the host. Incident response teams should also correlate any internal alerts that reference cryptocurrency transaction requests with this indicator, and consider containment actions such as isolating affected endpoints. Continuous re‑evaluation is advised, as additional telemetry may emerge that clarifies the hosting environment or reveals further malicious payloads associated with the domain.