secure-web-ndxxa-cdns[.]typedream[.]app

The domain secure-web-ndxxa-cdns.typedream.app has been identified as a brand impersonation phishing threat, specifically targeting users of the Canadian cryptocurrency exchange NDAX. Currently classified as offline, this domain posed as NDAX® Login page, attempting to steal credentials from crypto investors. The site was registered through Squarespace Domains II LLC on January 22, 2021, and resolves to IP 172.67.206.36. VirusTotal analysis shows that 19 out of 95 security vendors flagged this domain as malicious, and it appears on 2 security blocklists. The SSL certificate was issued by Google Trust Services under the identifier WE1, which is typical for legitimate sites but was misused here to appear trustworthy.

Despite being taken offline, the domain remains a significant risk indicator for ongoing phishing campaigns targeting NDAX users. The elevated risk level is justified by the combination of brand impersonation, multiple vendor flags, and registration through a known domain registrar. PhishDestroy recommends that users who may have encountered this domain avoid entering any credentials or personal information. If any data was submitted, users should immediately change their NDAX account passwords, enable two-factor authentication, and monitor accounts for unauthorized activity. Reporting the domain to relevant authorities and blocking it at the network level is also advised to prevent future access.