ndaxlogn[.]webflow[.]io

Analysis of ndaxlogn.webflow.io indicates active brand impersonation targeting Bitcoin users. The site resolves to IP 172.64.151.8, a Cloudflare‑hosted address located in Canada, and is served over HTTPS with a certificate issued by Google Trust Services under the WE1 designation. Infrastructure details show the domain is built on Webflow, protected by Cloudflare, and supports HTTP/3. Nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com confirm the use of Cloudflare DNS. Registration records list MarkMonitor, Inc. as the registrar, with a creation date of May 08, 2013. VirusTotal scans have flagged the domain by 18 of 91 security vendors, and it is listed on at least one public blocklist. The page title "NDAX Login | Buy Bitcoin in Canada - Canadian Crypto Exchange" suggests the site is attempting to masquerade as a legitimate cryptocurrency exchange, aligning with the reported scam type of a fake exchange. Gridinsoft assigns a trust score of 0/100, reinforcing the malicious assessment. While the exact page content has not been examined, the convergence of high‑risk classification, multiple vendor detections, and blocklist presence warrants a defensive posture. Organizations should block the domain at the network perimeter, add it to URL filtering policies, and monitor for related indicators such as the associated IP address and Cloudflare nameservers. Continuous threat‑intel updates are recommended to capture any changes in the domain's infrastructure or detection status.