naviq[.]top

This domain was registered on November 7, 2025, through Dynadot LLC, and as of July 12, 2026, it remains active. It resolves to IP address 172.67.204.21 hosted in the United States on AS13335 (Cloudflare, Inc.), with nameservers aria.ns.cloudflare.com and arturo.ns.cloudflare.com. The page title reported is BigONE, indicating the site is impersonating the BigONE cryptocurrency exchange platform. The domain uses a Let's Encrypt R12 SSL certificate and returns HTTP status 200. VirusTotal analysis shows 10 out of 95 security vendors flagging this domain as malicious. It also appears on two security blocklists and has been blocked by PhishDestroy and ScamSniffer. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the assessment that this is a high-risk domain. Infrastructure analysis reveals that the domain is protected behind Cloudflare, which can obscure the true origin server and complicate takedown efforts. The combination of a recently registered domain impersonating a well-known exchange, low trust scores, and vendor detections strongly suggests this is an active phishing campaign targeting BigONE users. Defenders should block access to naviq.top at the network or email gateway level, update threat intelligence feeds with the associated indicators (domain, IP, SSL serial, nameservers), and monitor for related subdomains or variations. Users who may have visited the site should be warned to change any credentials entered and enable multi-factor authentication on their BigONE accounts. Further analysis of the page content or any captured credentials is advisable to fully assess the scope of the threat.