# xm26.top — SUSPICIOUS

> xm26.top is a fake cryptocurrency wallet site posing as a scam under investigation since March 26, 2026.

## Summary
PhishDestroy identifies xm26.top as a generic phishing domain actively distributing a fake cryptocurrency wallet scam. The domain remains under investigation as it has not yet been blocklisted despite its recent creation and active resolution to a high-risk IP address.

This domain, registered on March 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, resolves to IP 104.21.76.162. PhishDestroy notes that xm26.top has been flagged by 0 of 95 VirusTotal vendors, has no established trust score, and operates without a verified SSL certificate authority beyond Let's Encrypt. The absence of detections and recent domain registration strongly correlates with malicious intent, particularly in cryptocurrency-related phishing campaigns.

The current status of xm26.top is active, with active phishing indicators and no mitigation in place. Immediate action is required: users must avoid accessing the domain, report it to their security teams or domain registrars, and update network blocklists with the IP 104.21.76.162 and registrar NICENIC INTERNATIONAL GROUP CO., LIMITED. Security teams should prioritize monitoring for associated infrastructure, including subdomains or similar domains registered by the same entity, to prevent further exploitation.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2026-03-26 10:01:46
- Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED
- IP: 104.21.76.162

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/9a3ded9b-e567-4db5-951e-6cce361ba757
- PhishDestroy: https://phishdestroy.io/domain/xm26.top/
- LLM endpoint: https://phishdestroy.io/domain/xm26.top/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/xm26.top/
Last updated: 2026-03-30