portal--ndax--logii[.]webflow[.]io

This domain, portal--ndax--logii.webflow.io, has been identified as a brand impersonation threat targeting investment platforms, specifically designed to deceive users into believing they are interacting with a legitimate cryptocurrency trading service. The domain impersonates the brand 'Ndax', which is known for its crypto trading services aimed at Canadian users. This impersonation attempts to exploit users by presenting a fraudulent interface resembling a legitimate platform, likely with the intent of harvesting sensitive personal and financial data.

Technical analysis of portal--ndax--logii.webflow.io reveals that it is flagged by 18 out of 95 security vendors on VirusTotal, indicating significant recognition as a threat. The domain was created on March 12, 2026, and is registered through Webflow, resolving to the IP address 172.64.151.8, hosted in the United States under AS13335 Cloudflare, Inc. It also possesses an SSL certificate labeled WE1 and currently appears on one security blocklist, indicating its recognition as a malicious entity in security databases.

Currently, the domain is classified as active and has been blocked by PhishDestroy. The risk level is elevated due to the brand impersonation and potential for significant financial and personal data loss. Users are advised to verify the legitimacy of URLs before interacting and to use security solutions that can identify and block malicious domains to mitigate ongoing threats. Ongoing monitoring and additional blocklisting actions may be necessary to ensure user safety.