xmnrlusd[.]live

This domain is flagged as an active phishing site targeting users of the XRP Ledger (XRPL) ecosystem. Analysis indicates the site mimics an official Xaman XRPL Loyalty & RLUSD Allocation Program, designed to deceive visitors into disclosing wallet credentials, private keys, or transferring assets under false pretenses. The fraudulent page leverages social engineering tactics, including fabricated reward claims and urgency prompts, to exploit users seeking legitimate token distributions or loyalty incentives. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain xmnrlusd.live was registered on May 26, 2024, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious registrations. It resolves to the IP address 172.67.133.235 and is currently detected by 5 out of 95 security vendors on VirusTotal. The domain appears on three independent security blocklists, and its Gridinsoft trust score is 0/100. The site employs a Let's Encrypt SSL certificate, which, while providing encryption, does not validate legitimacy and is commonly exploited by threat actors to lend false credibility. Users who have visited xmnrlusd.live or interacted with its content should immediately revoke any connected wallet permissions and transfer assets to a new, secure wallet. All credentials or private keys entered on the site must be considered compromised. It is recommended to monitor accounts for unauthorized transactions and report the incident to relevant security teams or blockchain analytics platforms. No legitimate allocation or loyalty program would require direct submission of private keys or seed phrases. Users are advised to verify official communications only through authenticated channels associated with the XRP Ledger or Xaman wallet.