navi-protocol[.]xyz

The domain navi-protocol.xyz is a confirmed phishing site engaged in brand impersonation targeting Sei, a cryptocurrency platform. It presents itself as a legitimate token distribution portal but is designed to deceive users into disclosing sensitive information or transferring assets under false pretenses. No crypto drainer kit was identified in this campaign. The site is currently taken offline, though prior activity classified it as an elevated-risk threat due to its deceptive nature and direct targeting of Sei’s branding.

Technical analysis of navi-protocol.xyz reveals limited but notable detection. The domain was flagged by 1 of 95 security vendors on VirusTotal, including SOCRadar, and appears on 3 security blocklists: PhishDestroy, MetaMask, and SEAL. Registered through PDR Ltd. d/b/a PublicDomainRegistry.com on February 26, 2026, the domain resolves to the IP address 188.114.96.3, hosted on Cloudflare’s infrastructure (AS13335) in the US. No SSL certificate was issued, and the observed page title was 'Token Distribution'. Nameservers for the domain are rohin.ns.cloudflare.com and venus.ns.cloudflare.com.

Users who interacted with navi-protocol.xyz should immediately change any credentials entered on the site, enable two-factor authentication on their Sei or other cryptocurrency accounts, and monitor for unauthorized transactions. Since no drainer kit was detected, revoking token approvals is not strictly necessary, but vigilance is advised. Report the domain to relevant platforms, including the impersonated brand Sei, and submit it to additional blocklists such as Google Safe Browsing or PhishTank to prevent further abuse.