nldaxx-account[.]com

This domain, nldaxx-account.com, is confirmed as a credential harvesting infrastructure specifically designed to impersonate Ndax, a cryptocurrency exchange platform. Analysis indicates the site employs brand impersonation tactics, presenting a fabricated interface with the page title '1 new message' to deceive users into submitting account credentials or private keys. No evidence of a drainer kit was observed in initial scans, though the site's structure suggests it may be part of a broader phishing campaign targeting digital asset holders. Infrastructure analysis reveals the domain was registered on February 21, 2026, through CNOBIN INFORMATION TECHNOLOGY LIMITED, a registrar frequently associated with malicious registrations. The domain resolves to IP address 172.67.154.85, hosted on AS13335 (Cloudflare, Inc.), a network commonly exploited to obscure phishing infrastructure. As of the latest scan, VirusTotal reports 20 out of 95 security vendors flagging the domain as malicious. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, and lacks an SSL certificate, further indicating its illegitimate nature. No entries were found in Google Safe Browsing at the time of analysis. The domain is currently offline, likely taken down following detection by security vendors or hosting provider intervention. However, residual risk persists due to the potential for infrastructure reuse or migration to newly registered domains. Users who interacted with the site are advised to revoke any active sessions, rotate credentials, and monitor accounts for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP address to prevent future access attempts. Continuous monitoring of newly registered domains under the same registrar is recommended to identify potential campaign resurgence.