ndaxxlogogin[.]webflow[.]io

This domain, ndaxxlogogin.webflow.io, is actively flagged as a high-risk phishing site targeting users of the NDAX cryptocurrency exchange. Analysis indicates the page title explicitly presents itself as 'NDAX® | Login: Canada’s Most Secure Crypto Exchange,' directly mimicking the branding of the legitimate NDAX platform. The domain was registered on February 15, 2026, through Webflow and is currently resolving to IP address 172.64.151.8, which is associated with Cloudflare infrastructure. The use of Cloudflare and HTTP/3 suggests attempts to obscure hosting details and enhance perceived legitimacy, while the SSL certificate issued by Google Trust Services further reinforces a false sense of security for potential victims. Security vendors have detected malicious activity on this domain, with 17 out of 95 engines on VirusTotal flagging it as harmful. The domain also appears on at least one security blocklist and has been blocked by PhishDestroy. Gridinsoft assigns it a trust score of 0/100, indicating a confirmed malicious classification. While the exact phishing kit or backend infrastructure remains unconfirmed, the combination of brand impersonation, recent registration, and active security flags strongly suggests this is a credential-harvesting operation targeting NDAX users. Defenders should treat this domain as an active threat. Network-level blocking is recommended, and affected users should be advised to reset credentials on the legitimate NDAX platform immediately. Further analysis of the page content and backend connections could provide additional indicators of compromise, but current evidence alone justifies immediate containment measures.