navomex[.]com

PhishDestroy identifies navomex.com as an active crypto drainer domain impersonating the MEXC cryptocurrency exchange. This malicious site was registered on March 13, 2026, and currently resolves to IP 104.21.34.107. Despite being hosted and SSL-certified (Let's Encrypt), VirusTotal scans return 0 detections out of 95 engines, indicating it remains undetected by antivirus solutions. The domain was registered through Global Domain Group LLC, a known domain registrar with a history of facilitating fraudulent activity.

This domain specifically targets cryptocurrency users by mimicking the MEXC platform to trick victims into connecting their wallets or entering sensitive login credentials. The low detection rate on VirusTotal suggests a new and rapidly evolving threat that has not yet been widely flagged by security vendors. Given the absence of blocklist entries at this time, navomex.com poses a high risk to unsuspecting users who may unknowingly expose their assets or credentials.

Users who have visited navomex.com should immediately disconnect from the site, revoke any wallet connections, and scan their devices for malware. If credentials were entered, users should change passwords and enable two-factor authentication on their legitimate MEXC accounts. Report the domain to PhishDestroy and your antivirus provider to help block its infrastructure. Avoid interacting with this site and verify all cryptocurrency-related domains against PhishDestroy’s threat database before proceeding.