sso-ndax-logi[.]webflow[.]io

Analysis of sso-ndax-logi.webflow.io shows a high‑risk credential phishing operation. The site was created on 2026‑04‑02 and is hosted on a Webflow‑provided domain that resolves to IP 104.18.36.248, a Cloudflare address located in Canada. The TLS certificate is issued by Google Trust Services (WE1), indicating a valid HTTPS connection, which may increase user trust. VirusTotal reports that 21 of 94 security vendors flag the domain, and Gridinsoft assigns a trust score of 0/100. The page title advertises "NDAX® | Login: Canada’s Most Secure Crypto Exchange," matching the listed scam type of credential phishing. The domain appears on one security blocklist and is already blocked by PhishDestroy. While the underlying page content has not been inspected, the combination of recent registration, hosting on a shared Webflow infrastructure, a reputable SSL certificate, and multiple vendor detections strongly suggests a malicious intent to harvest credentials for NDAX. Defenders should immediately block the domain and its resolving IP at perimeter and DNS layers, monitor outbound traffic for connections to the IP, and enforce multi‑factor authentication for any accounts that could be targeted. Continued observation of related Webflow subdomains and rapid sharing of indicators of compromise with threat‑intel platforms are recommended to mitigate potential spread.