xm26[.]top

PhishDestroy identifies xm26.top as a generic phishing domain actively distributing a fake cryptocurrency wallet scam. The domain remains under investigation as it has not yet been blocklisted despite its recent creation and active resolution to a high-risk IP address.

This domain, registered on March 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, resolves to IP 104.21.76.162. PhishDestroy notes that xm26.top has been flagged by 2 of 95 VirusTotal vendors, has no established trust score, and operates without a verified SSL certificate authority beyond Let's Encrypt. The absence of detections and recent domain registration strongly correlates with malicious intent, particularly in cryptocurrency-related phishing campaigns.

The current status of xm26.top is active, with active phishing indicators and no mitigation in place. Immediate action is required: users must avoid accessing the domain, report it to their security teams or domain registrars, and update network blocklists with the IP 104.21.76.162 and registrar NICENIC INTERNATIONAL GROUP CO., LIMITED. Security teams should prioritize monitoring for associated infrastructure, including subdomains or similar domains registered by the same entity, to prevent further exploitation.