sso--secure--cdn--ndax--authth[.]webflow[.]io

This domain, sso--secure--cdn--ndax--authth.webflow.io, is identified as a credential phishing resource targeting users of cryptocurrency exchange authentication systems. Analysis indicates the domain mimics a single sign-on (SSO) or content delivery network (CDN) endpoint associated with a legitimate platform, likely exploiting typosquatting or subdomain spoofing techniques to deceive victims. The inclusion of terms such as 'secure,' 'cdn,' and 'auth' in the subdomain structure suggests an attempt to appear as a trusted authentication gateway, increasing the likelihood of successful credential harvesting. No specific drainer kit signatures were observed, though the domain aligns with patterns commonly used in cryptocurrency-focused phishing campaigns. Technical indicators confirm the domain's malicious classification. It resolves to the IP address 172.64.151.8, geolocated to a Cloudflare, Inc. infrastructure in Canada, a common hosting provider for both legitimate and malicious sites. The domain is registered through Webflow, a platform frequently abused for rapid deployment of phishing pages due to its ease of use and free tier availability. As of the latest assessment, 18 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on a single security blocklist. The page title, '404 - Page not found,' suggests the phishing content may have been removed or relocated, though residual risk remains due to the domain's prior use. No Google Safe Browsing (GSB) detections were recorded at the time of analysis. The domain is currently offline, likely due to takedown efforts or voluntary suspension by the registrar. However, the infrastructure remains a residual threat, as attackers may repurpose the domain or migrate to a similar subdomain under the same registrar. Users who interacted with the domain prior to its deactivation are advised to rotate credentials immediately, particularly for cryptocurrency-related accounts. Organizations should monitor for related indicators of compromise, including the IP address 172.64.151.8 and any subdomains registered through Webflow with similar naming conventions. Proactive blocking of the domain and its resolved IP is recommended to mitigate further exposure.