nav-monpay[.]wixstudio[.]com

This domain, nav-monpay.wixstudio.com, operates as a crypto wallet drainer, designed to deceive users into connecting their digital wallets to a fraudulent interface. Once connected, the site executes unauthorized transactions, siphoning cryptocurrency assets directly from the victim’s wallet. The threat targets users through impersonation of legitimate payment or wallet service portals, leveraging social engineering to prompt urgent or seemingly routine actions, such as account verification or transaction confirmation. Analysis indicates the domain was registered on December 17, 2016, through GoDaddy.com, LLC, though recent activity suggests it has been repurposed for malicious use. It resolves to the IP address 34.144.206.118 and is secured with a Let’s Encrypt SSL certificate, which is commonly exploited to lend a false sense of legitimacy. The domain appears on five security blocklists and is flagged by 5 out of 95 security vendors on VirusTotal, including MetaMask, PhishDestroy, and PhishingArmy. A Gridinsoft trust score of 0/100 further corroborates its malicious classification. Users who have visited nav-monpay.wixstudio.com or interacted with its content should immediately disconnect any connected wallets and revoke permissions granted to unknown or suspicious applications. It is critical to review all recent transactions for unauthorized activity and transfer remaining assets to a new, secure wallet. Enabling multi-factor authentication and monitoring for phishing attempts via email or messaging platforms is strongly advised. If credentials were entered, reset passwords for all associated accounts and consider reporting the incident to relevant cybersecurity authorities or wallet service providers.