nav-coin-en-pro-io[.]pages[.]dev

nav-coin-en-pro-io.pages.dev has been flagged for hosting an active crypto drainer phishing campaign, designed to deceive users into connecting cryptocurrency wallets and approving fraudulent transactions. The domain impersonates a legitimate crypto service, leveraging a replica interface to steal funds through malicious smart contract interactions. This tactic aligns with common drainer-as-a-service kits observed in the wild, where threat actors deploy cloned portals to siphon assets from unsuspecting victims. The infrastructure suggests a coordinated effort to exploit wallet holders under the guise of promotional or technical verification pages.

Technical indicators confirm the malicious nature of this domain. It has zero detections on VirusTotal (4/95) despite active abuse, indicating evasion against current detection engines. Hosting is provided by Cloudflare, Inc., resolving to IP 172.66.47.97 via a Google Trust Services SSL certificate. The domain was registered recently under Cloudflare's Pages service, though the exact creation date is obscured by Cloudflare's privacy protections. It remains unlisted on Google Safe Browsing (GSB) and has not been flagged by major blocklists, allowing continued operation with minimal interference. These attributes indicate a newly deployed, actively maintained phishing asset with low visibility in threat feeds.

The campaign remains active as of the latest scan. Immediate remediation is advised: block the domain at DNS, firewall, and email gateways; disconnect any connected wallets; and audit transaction histories for unauthorized transfers. While GSB and other blocklists lag in detection, proactive blocking via the provided indicators can prevent compromise. Remaining risk is elevated due to zero detections and cloudfront-located infrastructure, emphasizing the need for real-time monitoring and user awareness to mitigate fund loss.