register-xaman[.]app

This domain, register-xaman.app, operates as a credential phishing site designed to deceive users of XRP wallets by impersonating an official XRP Community Day voting platform. The site presents a fabricated voting interface under the title 'Xaman – XRP Community Day | Vote,' aiming to harvest sensitive wallet credentials, including private keys or recovery phrases. Such stolen information enables attackers to gain unauthorized access to victims' cryptocurrency holdings, leading to immediate financial theft and potential long-term account compromise. Analysis indicates this domain exhibits multiple high-risk characteristics. It was registered on May 30, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious domains. The site resolves to the IP address 188.114.96.3 and is flagged by 11 out of 95 security vendors on VirusTotal, including detections for social engineering tactics. Additionally, the domain appears on four security blocklists and is actively blocked by multiple threat intelligence platforms. Infrastructure analysis reveals the use of Cloudflare services, which may obscure the true origin of the malicious activity. Users who visited register-xaman.app should immediately cease all interaction with the site and assume their credentials may be compromised. If any sensitive information, such as wallet passwords or recovery phrases, was entered, the affected wallet should be considered at risk. Users are advised to transfer assets to a new, secure wallet using a trusted device and enable multi-factor authentication where available. Monitor all linked accounts for unauthorized transactions and report the incident to relevant cryptocurrency security teams for further mitigation. Regularly update security software and verify the authenticity of any cryptocurrency-related communications before engaging.