novaxmetals[.]org

This domain is flagged as a high-risk phishing site designed to impersonate the BitMart cryptocurrency exchange. Analysis indicates it presents a fake login interface to harvest user credentials, private keys, or recovery phrases, potentially leading to unauthorized access and financial theft. The site specifically targets individuals attempting to access their crypto wallets or exchange accounts, tricking them into entering sensitive information on a fraudulent platform. Infrastructure analysis reveals multiple technical indicators confirming its malicious nature. The domain was registered on November 2, 2025, through Gname.com Pte. Ltd., an uncommon registrar for legitimate financial services. It resolves to IP address 104.21.7.44, hosted on Cloudflare infrastructure (AS13335), which is frequently abused by threat actors to conceal their operations. Security vendors on VirusTotal detect this domain as malicious, with 4 out of 95 engines flagging it. Additionally, it appears on three security blocklists, including those maintained by cryptocurrency-focused threat intelligence sources. If you visited novaxmetals.org or entered any information on the site, immediate action is required. Disconnect the device from the internet to prevent potential data exfiltration. Revoke any active sessions on legitimate cryptocurrency platforms and change passwords using a secure, unrelated device. Enable multi-factor authentication if not already active. Monitor all linked accounts for unauthorized transactions and report any suspicious activity to the legitimate exchange. Consider resetting wallet recovery phrases if private keys or seed phrases were exposed. Scan the device for malware using updated security tools to ensure no persistent threats remain.