auth-signup-ndax[.]webflow[.]io

auth-signup-ndax.webflow.io poses a specific threat of brand impersonation, targeting users of the cryptocurrency exchange Ndax. The domain is designed to mimic the official NDAX login page, potentially leading users to unwittingly disclose their credentials to attackers. This can result in unauthorized access to user accounts, financial loss, and compromise of personal data.

Analysis indicates that 17 out of 95 security vendors on VirusTotal flagged this domain as malicious, suggesting a significant level of suspicion. The domain was registered through NameCheap, Inc. on February 21, 2026, and is currently offline. It resolves to the IP address 104.18.36.248, which is hosted by Cloudflare, Inc. in the United States (US, AS13335). The domain appears on one security blocklist and is blocked by PhishDestroy. The SSL certificate is issued by Google Trust Services, which might lend a false sense of security to unsuspecting visitors.

Users who have visited auth-signup-ndax.webflow.io are advised to immediately change their passwords for all related accounts, including their NDAX account and any other financial or sensitive accounts. They should also monitor their financial statements for any unauthorized transactions and report suspicious activity to Ndax customer support. Additionally, users should be cautious of any links or emails purporting to be from Ndax and verify the legitimacy of the domain before entering any credentials.