ssso-ndax-loginn[.]webflow[.]io

This domain, ssso-ndax-loginn.webflow.io, is actively impersonating Ndax, a cryptocurrency exchange platform, as part of a credential phishing operation. Registered on February 21, 2026, through NameCheap, Inc., the domain currently resolves to 104.18.36.248 (AS13335, Cloudflare, Inc.) and is hosted on infrastructure utilizing Cloudflare nameservers (journey.ns.cloudflare.com, lamar.ns.cloudflare.com). The page title, 'NDAX® Login | Buy Bitcoin in Canada - Log Into My Account,' explicitly targets Ndax users, reinforcing the credential phishing classification. The domain remains operational with an HTTP 200 status, and its SSL certificate is issued by Google Trust Services (WE1). Security vendors have flagged this domain, with 14 of 93 engines on VirusTotal detecting malicious activity, and it appears on at least one security blocklist, including PhishDestroy. The site employs Webflow and HTTP/3 technologies, which are consistent with modern phishing kits designed to evade detection. While the exact content and functionality of the phishing page have not been analyzed, the combination of brand impersonation, active status, and security vendor detections indicates a high-risk threat. Defenders should prioritize blocking this domain at the DNS or network level, particularly in environments where cryptocurrency-related services are accessed. Monitoring for related infrastructure, such as additional domains registered through the same registrar or resolving to the same IP, may help identify broader campaign activity. Given the domain's recent creation and continued operation, further investigation into its hosting and registration patterns is recommended to assess potential links to other phishing operations.