xamanpro[.]app

This domain, xamanpro.app, is flagged as a high-risk brand impersonation resource specifically targeting Ledger cryptocurrency wallet users. Analysis indicates the site masquerades as a legitimate XRP Ledger wallet interface, presenting itself under the page title 'Xaman | Xaman Pro - XRP Ledger Wallet.' The objective appears to be the deployment of crypto drainer malware, designed to siphon digital assets from unsuspecting victims by mimicking trusted wallet software. No direct evidence of a specific drainer kit was observed, but the combination of brand impersonation and wallet-themed content strongly suggests malicious intent aligned with cryptocurrency theft operations. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Hosting Concepts B.V. d/b/a Registrar.eu, a registrar commonly associated with both legitimate and malicious registrations. The domain resolves to the IP address 92.113.23.211, which is hosted on infrastructure utilizing Hostinger CDN and HTTP/3 protocols. Detection metrics indicate broad recognition of the threat, with 13 out of 95 security vendors on VirusTotal flagging the domain as malicious. Additionally, the domain appears on three distinct security blocklists, and MetaMask, SEAL, and PhishDestroy have implemented active blocks. Gridinsoft assigns a trust score of 0 out of 100, further corroborating the high-risk assessment. Google Safe Browsing status was not explicitly provided, but the cumulative detection data suggests likely inclusion. As of the latest assessment, xamanpro.app has been taken offline, reducing immediate exposure to potential victims. However, the domain remains registered and could be reactivated or repurposed for future malicious campaigns. Users who may have interacted with the site are advised to revoke any connected wallet permissions, monitor transaction histories for unauthorized activity, and verify the authenticity of any cryptocurrency wallet software through official channels. The infrastructure and registration details suggest the threat actor may retain control of the domain, warranting continued vigilance from security teams and end-users alike.