sso-eng-ndax---cdn-authh[.]webflow[.]io

The domain sso-eng-ndax---cdn-authh.webflow.io has been identified as a confirmed phishing site. This domain mimics the branding of NDAX, a well-known Canadian cryptocurrency exchange, and is designed to deceive users into providing sensitive information. No specific drainer kit has been identified, but the domain's structure and page title suggest a sophisticated attempt to replicate the legitimate NDAX login page.

Analysis indicates that the domain has a VirusTotal score of 18/95, with 18 out of 95 security vendors flagging it as malicious. The domain is registered through Webflow and resolves to the IP address 104.18.36.248. It was created on June 12, 2026, and uses an SSL certificate issued by Google Trust Services. The Gridinsoft trust score for this domain is 0/100, indicating a complete lack of trust. The domain appears on one known security blocklist and is blocked by the PhishDestroy service.

The domain is currently offline, and this status suggests that the hosting infrastructure has been taken down in response to the detected threat. Despite the domain being offline, the risk remains elevated due to the potential for the domain to be reactivated or for similar domains to be registered by the same actors. Users are advised to remain vigilant and avoid clicking on any links or entering credentials on any unfamiliar or suspicious websites, even if they appear to be legitimate.