votings-xaman[.]com

votings-xaman.com was registered on June 22, 2026 through Web Commerce Communications Limited dba WebNic.cc. The authoritative name servers are brian.ns.cloudflare.com and mallory.ns.cloudflare.com, pointing the domain to the Cloudflare IP address 172.67.181.166, which belongs to AS13335 Cloudflare, Inc. and resolves to a location in the United States. The TLS certificate presented by the host is issued by Google Trust Services under the WE1 intermediate, indicating a legitimate certificate chain despite the malicious intent. The site’s only observed page title, "Xaman – XRP Community Day | Vote & Claim Your Allocation," suggests an attempt to lure victims with a cryptocurrency‑related voting or claim scheme.

The domain is currently offline, but historical observations show it was blocked by three independent malware and phishing mitigation services – PhishDestroy, MetaMask, and SEAL – and appears on three security blocklists. Gridinsoft assigned a trust score of 0 out of 100, reflecting extreme suspicion. VirusTotal scans recorded three positive detections out of ninety‑one scanners, reinforcing the malicious classification.

No additional technical artefacts such as payload hashes, command‑and‑control endpoints, or redirect chains have been published, leaving the full attack vector unknown. Defenders should add the domain and its associated IP address to deny‑list rules, ensure that any client‑side extensions that interact with XRP or voting mechanisms (e.g., MetaMask) block connections, and monitor the registrar WebNic.cc for further registrations that may reuse the same infrastructure. Continuous re‑evaluation is advised should the site become active again, at which point content analysis and network traffic capture would be required to fully characterize the threat.