xrpl-xaman[.]app

Analysis of the domain xrpl-xaman.app, first observed on February 21 2026, indicates an active brand-impersonation campaign targeting the Xaman brand. The domain resolves to the Cloudflare-owned address 172.67.179.224, which is registered to AS13335 in the United States. Registration was performed through NICENIC INTERNATIONAL GROUP CO., LIMITED, and the authoritative nameservers are chan.ns.cloudflare.com and watson.ns.cloudflare.com, confirming the use of Cloudflare's DNS infrastructure. The site presented the page title "Even geduld…", but no TLS certificate was observed, meaning traffic is served over plain HTTP. Gridinsoft assigned a trust score of zero out of one hundred, reflecting an extremely low reputation.

The domain has been added to at least one public blocklist and was flagged by the PhishDestroy sinkhole service, which has since taken the site offline. VirusTotal analysis shows that two of ninety-three scanned security vendors marked the domain as malicious, providing limited but corroborating detection. The listed scam type is "Crypto Scam", suggesting that the content likely attempts to lure victims into cryptocurrency-related fraud. Uncertainty remains regarding the specific payload or phishing pages because the site is no longer reachable and no additional content snapshots are available. Defenders should block network connections to 172.67.179.224 and add xrpl-xaman.app to URL filtering policies, monitor for further domains using the same registrant or nameserver pattern, and consider sharing the indicator set with threat-sharing communities to accelerate detection of related infrastructure.

The lack of an SSL certificate eliminates the possibility of certificate-pinning bypass, but also indicates that the operators are not attempting to masquerade as a legitimate HTTPS site.