xaman-xrplservice[.]com

Analysis of xaman-xrplservice.com shows an active generic phishing infrastructure targeting cryptocurrency users. The domain was registered on June 16, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is hosted behind Cloudflare (AS13335) with the IP address 172.67.141.233 located in the United States. The site presents a generic page title "Just a moment..." and returns HTTP 403 responses, suggesting the content is intentionally hidden or dynamically served. SSL is provided by Google Trust Services / WE1, a legitimate certificate authority often used to lend credibility to malicious sites. The domain appears on three security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, indicating recognition by multiple threat‑intelligence feeds. VirusTotal scans report four of ninety‑one security vendors flagging the domain, and Gridinsoft assigns a trust score of 0/100, reinforcing its malicious reputation. Nameservers macy.ns.cloudflare.com and vern.ns.cloudflare.com confirm the use of Cloudflare's DNS service. The primary threat is classified as a "Crypto Drainer," implying attempts to lure victims into transferring digital assets to attacker‑controlled wallets. Current evidence does not reveal the exact phishing payload or lure page content, so the precise attack vector remains uncertain. Defenders should block the domain and its associated IP at perimeter filters, enforce URL filtering for any references to the domain, and monitor outbound cryptocurrency transactions for anomalous activity. Continuous re‑evaluation is advised as threat actors may modify the site to bypass existing defenses.