ndaxio[.]framer[.]media

ndaxio.framer.media is a tenant hostname on CSC Corporate Domains, Inc., not a separately registered domain. PhishDestroy first observed the hostname on Jan 26, 2026. The hostname explicitly references Ndax; stored content metadata identifies the same apparent target. The captured page title is “Log In | Ndax™(En-Us)”. Stored page analysis classifies the content as credential phishing. Current evidence score: 95/100 (critical).

Positive findings are stored from 3 sources: VirusTotal, Cloudflare Radar, and URLScan. VirusTotal recorded 18 detections among 95 engines: ADMINUSLabs, alphaMountain.ai, Cluster25, CRDF, CyRadar, DNS8, ESET, Emsisoft, Forcepoint ThreatSeeker, Fortinet, Gridinsoft, Kaspersky, Lionic, Netcraft, Sophos, Trustwave, VIPRE, Webroot on Jul 18, 2026 at 18:45 UTC. Cloudflare Radar classified the hostname as malicious and assigned the categories phishing and security threats; its verdict timestamp was not retained. URLScan returned a malicious verdict with score 100; scan metadata assigned phishing as its category on Jul 29, 2026 at 03:27 UTC. Non-positive and contextual checks: The external blocklist snapshot contained no matches on Aug 7, 2026 at 22:20 UTC. URLQuery recorded no positive detection; no observation timestamp was retained. Google Safe Browsing returned no flag on Mar 3, 2026 at 04:14 UTC. PhishStats returned no feed match on Mar 1, 2026 at 16:06 UTC.

HTTP 404 was recorded on Aug 7, 2026 at 01:05 UTC; content was unavailable. CSC Corporate Domains, Inc. is the hosting platform for this tenant, not its registrar. At collection time, the hostname resolved to 52.223.52.2 on AS16509 (AMAZON-02 - Amazon.com, Inc., US). The recorded endpoint location is Seattle, US. The IP and ASN identify shared CSC Corporate Domains, Inc. infrastructure, not the tenant operator. The stored server header is Framer/cc95054. DOM analysis on Jul 29, 2026 at 04:12 UTC returned 5/100. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. The platform TLS certificate was issued by Let's Encrypt / E7 with validity through May 18, 2026; checked Mar 15, 2026 at 05:42 UTC.

The content indicators and 3 positive source findings support the current Ndax-themed credential phishing classification.