xaman-world[.]app

The domain xaman-world.app has been identified as a brand impersonation phishing site targeting users of the Xaman Wallet, a popular XRP Ledger application. This fraudulent site mimics the legitimate Xaman Wallet interface to trick visitors into entering their login credentials, effectively functioning as a credential theft operation. No specific drainer kit has been confirmed, but the page title 'Xaman Wallet — Desktop, Extension & Login | XRPL Resource' indicates a sophisticated attempt to deceive users into believing they are accessing an official resource.

Technical analysis reveals that the domain was registered on April 07, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar known for hosting malicious domains. It resolves to IP address 104.21.14.115 and uses a Let's Encrypt SSL certificate with serial E8. VirusTotal reports 0 out of 95 security vendors detecting the site, meaning it has not yet been flagged by most antivirus engines. However, it appears on 1 security blocklist, indicating some threat intelligence sources have already identified it as malicious. Google Safe Browsing status is not explicitly mentioned but given the blocklist presence, the site is likely not yet blacklisted by Google.

As of the latest check, the site is offline, suggesting either the hosting provider or the domain registrar took action in response to reports. Despite this, the risk remains because the domain could be reactivated or redirected to a new IP. Users who may have visited the site before it went offline should consider their Xaman Wallet credentials compromised and take immediate steps to secure their accounts, including changing passwords and enabling two-factor authentication. PhishDestroy recommends avoiding any interactions with xaman-world.app and reporting it to relevant authorities to prevent future harm.