navi88[.]sbs

Analysis of the domain navi88.sbs, observed on August 06, 2026, indicates active malicious infrastructure consistent with a generic phishing operation. The domain was registered on August 03, 2026 through Global Domain Group LLC and is hosted on Cloudflare name servers ariella.ns.cloudflare.com and carl.ns.cloudflare.com. DNS resolution points to the IP address 104.21.39.169, a Cloudflare edge node that masks the origin server and is commonly leveraged by threat actors to conceal hosting location.

The domain appears on a single security blocklist and is explicitly blocked by the PhishDestroy service, confirming that at least one defensive feed has identified it as malicious. VirusTotal reports that 2 of 91 scanned security vendors flag the domain, providing additional corroboration of suspicious activity despite the low detection count. The domain’s current status is listed as still active, suggesting that the phishing campaign is ongoing.

Defenders should prioritize blocking outbound connections to 104.21.39.169 and add navi88.sbs to local blocklists. Monitoring for any future detections from additional security vendors is advised, as the low initial vendor count may increase as more analyses are performed. Given the recent registration date and active status, the threat is high‑risk and warrants immediate remediation.