xmev[.]io

Analysis of the domain xmev.io, first observed on February 21 2026, indicates a wallet/seed phishing operation that impersonates the “across” brand. The site was hosted behind Cloudflare’s network (ASN 13335) and resolved to the IPv4 address 172.66.155.200, which geolocates to the United States. DNS configuration shows authoritative nameservers macy.ns.cloudflare.com and rory.ns.cloudflare.com, and the domain’s MX records point to Zoho mail servers (mx.zoho.com, mx2.zoho.com), a pattern often used to lend legitimacy to malicious campaigns. The presented SSL certificate is identified only as “WE1”, providing no public‑key fingerprint or extended validation, which is consistent with rapid‑deployment phishing infrastructure.

The HTTP response returned a page title “xmev.money”, a mismatch to the domain name that further suggests an attempt to trick users into believing they are interacting with a financial service. VirusTotal scans reported three detections out of ninety‑three participating engines, confirming that a subset of security products recognize the domain as malicious. Independent blocklists have listed the domain once, and the PhishDestroy service has already taken the site offline, confirming that active mitigation measures are in place. While the domain’s registration details beyond the creation date are not disclosed, the observable infrastructure – Cloudflare IP, Zoho MX configuration, and minimal SSL validation – aligns with known patterns of brand‑impersonation phishing kits.

The exact content of the page has not been captured, leaving the specific user‑experience elements unverified. Defenders should block traffic to 172.66.155.200 and add xmev.io to URL filtering policies. Monitoring for additional domains registered by the same nameservers or MX configuration may reveal further campaign extensions. Continued scanning with multi‑engine services is advisable to capture any future changes in detection rates.