homepage-signup-ndax[.]webflow[.]io

The domain homepage-signup-ndax.webflow.io is identified as a brand impersonation threat specifically targeting Ndax, a cryptocurrency exchange platform. Analysis confirms the domain is currently offline, though it previously hosted a fraudulent login page mimicking the official Ndax site. The page title, "NDAX® | Login (Official Site)®: Canada’s Most Secure Crypto Exchange™," was designed to deceive users into believing they were accessing a legitimate service, increasing the risk of credential theft or financial fraud. Infrastructure analysis reveals the domain was created on February 21, 2026, and registered through NameCheap, Inc. It resolved to the IP address 172.64.151.8 and was flagged by 17 of 95 security vendors on VirusTotal. Additionally, the domain appeared on one security blocklist, indicating prior detection by threat intelligence systems. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the malicious intent, as fraudulent domains frequently leverage valid certificates to appear legitimate. Given the domain's current offline status, no active threat is present; however, users should remain vigilant. Any future reappearance of this domain or similar infrastructure should be treated as hostile. Organizations are advised to block the domain and associated IP in perimeter defenses, while individuals should verify the authenticity of cryptocurrency platforms by cross-referencing official URLs and enabling multi-factor authentication on all financial accounts.