navprotrocol[.]bond

Analysis of the domain navprotrocol.bond indicates that it was registered on February 23, 2026 through NameSilo, LLC and is hosted on Cloudflare infrastructure (AS13335, United States). The domain resolves to IP address 188.114.96.3, which is owned by Cloudflare, Inc. No SSL certificate was observed for the site, suggesting the connection was served over plain HTTP. The page title retrieved from the site was "Token Distribution," and the underlying phishing kit has been identified as an Airdrop Scam, a common tactic used to lure victims into submitting cryptocurrency wallet credentials. The domain explicitly impersonates the blockchain platform Sei, aligning with the brand target information supplied.

Security controls have taken action: the site was blocked by PhishDestroy and appears on a single security blocklist. VirusTotal analysis shows that one of ninety‑three security vendors flagged the domain, providing an additional indicator of compromise. Current operational status is offline, confirming that the malicious content is no longer reachable.

Defenders should continue to enforce DNS‑based blocking for navprotrocol.bond, monitor for any re‑registration attempts, and watch for similar naming patterns that combine misspelled words with the .bond TLD. Additional mitigation includes updating endpoint and email filters to recognize the "Token Distribution" page title and the Airdrop Scam kit signature. Given the use of Cloudflare’s shared hosting, threat actors may pivot to other domains on the same nameservers (isla.ns.cloudflare.com, razvan.ns.cloudflare.com), so broader monitoring of these resolvers is advised.