sso-en-kucoiin[.]webflow[.]io

This domain, sso-en-kucoiin.webflow.io, poses a targeted brand impersonation threat against Ndax, a cryptocurrency exchange platform. The site mimics the legitimate Ndax Canada Inc. interface, likely to harvest user credentials, payment details, or deploy crypto-draining malware. Analysis of the page title confirms the impersonation attempt, displaying 'Ndax Canada Inc.' to deceive visitors into believing they are accessing an official portal. Such tactics are commonly used to exploit trust in established brands, leading to financial theft or unauthorized account access. Infrastructure analysis reveals multiple technical indicators supporting the malicious classification. The domain is flagged by 15 out of 95 security vendors on VirusTotal, indicating a consensus among detection engines. Registered through MarkMonitor, Inc. on May 8, 2013, the domain leverages an aged registration to appear legitimate. It resolves to IP address 172.64.151.8, hosted on Cloudflare’s infrastructure (AS13335), a common tactic to obscure origin and evade takedowns. The domain appears on two security blocklists, including PhishDestroy and PhishingDB, further validating its malicious intent. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as encrypted phishing sites are now standard practice. Users who visited sso-en-kucoiin.webflow.io should assume their credentials or financial details may have been compromised. Immediately revoke any active sessions on the legitimate Ndax platform and enable multi-factor authentication if not already active. Monitor accounts for unauthorized transactions and report suspicious activity to the official exchange. Clear browser cache and cookies to remove any residual tracking elements. If crypto wallet interactions occurred, transfer assets to a new wallet and audit connected applications for unauthorized access. Organizations should update internal blocklists to include this domain and its resolving IP to prevent future exposure.