Fake 'monthly XRP release' offer uses Xaman wallet branding on lookalike domains
MalwareTips warns of a fake 'monthly XRP release' offer that borrows the Xaman wallet's identity on lookalike domains such as xamanwallet-token[.]pro and xaman-wallet[.]com to push wallet approvals; Xaman is not involved.
- First reported
- Reports
- 1
Source: malwaretips.com · published
What happened
In a warning published 17 October 2026, MalwareTips describes a "Xaman monthly XRP release" scam that borrows the identity of the real Xaman (formerly Xumm) self-custody wallet for the XRP Ledger to promote a supposed rewards programme. Reported versions advertise an airdrop or monthly payments, and one version promises 10% of the user's XRP holdings each month. MalwareTips names the reported lookalike domains xamanwallet-token[.]pro and xaman-wallet[.]com and says they are not official Xaman services; Xaman is impersonated and not involved. Its lead image is an illustrative reconstruction, not a capture of a campaign page.
How the scam works
The pitch makes the reward sound like part of a service the reader already uses. "Monthly XRP release" suggests an established programme, and an airdrop version suggests existing holders only need to claim. That works best on people who already own XRP, but holding the asset doesn't make anyone eligible for an invented programme. MalwareTips also notes that the XRP Ledger does not use proof-of-stake, so a "monthly release" cannot be a native staking entitlement.
The lookalike domains place the Xaman name beside wallet-related words so they pass a quick glance, and a browser padlock only secures the connection to whatever site you reached. The page then asks visitors to connect a wallet or continue through a wallet prompt to "check eligibility" or "receive rewards". Words such as "verify", "synchronize" and "activate" describe a claimed purpose, not what an approval actually does. MalwareTips explains that viewing a public address, requesting information and authorising a transaction are different actions; the danger lies in what the page persuades someone to approve or disclose. A genuine wallet can faithfully display a harmful request from another party, and a recovery phrase or private key gives control far beyond one website visit.
MalwareTips advises opening Xaman's official website separately, using trusted bookmarks or the app's own support route, and never following a campaign's own "support" links.
Source
MalwareTips, "Xaman Monthly XRP Release Scam: Fake 10% Rewards And Wallet Theft Exposed" (published 17 October 2026).
Red flags
- Offers of monthly XRP payments, a percentage of your holdings, or an airdrop for Xaman users.
- Domains that combine 'xaman' with extra words or hyphens (xamanwallet-token[.]pro, xaman-wallet[.]com).
- An 'eligibility check' that requires connecting or approving something in your wallet.
- Any request for a recovery phrase, secret numbers or private key.
If you were targeted
- 1Don't connect your wallet, sign, or approve anything on the page.
- 2Never type a recovery (seed) phrase or private key into a website or give it to 'support'.
- 3Check announcements only through the project's official website or accounts that you open yourself.
- 4If you connected and approved something, revoke the token approval with your wallet's or the network's approval tool and move remaining assets to a new wallet if you're unsure what you signed.
- 5If you disclosed a recovery phrase, treat the wallet as compromised and move assets to a new wallet created with a new phrase.
- 6Report the site to your wallet provider and, in the U.S., to the FBI's IC3 at ic3.gov.