logi-ndax-usa[.]webflow[.]io

This domain, logi-ndax-usa.webflow.io, poses as the official login portal for NDAX, a Canadian cryptocurrency exchange. Analysis indicates the site is designed to harvest user credentials by mimicking the legitimate NDAX interface, targeting individuals attempting to access their crypto wallets. The fraudulent page uses identical branding, including the tagline 'Canada’s Most Secure Crypto Exchange,' to deceive visitors into entering sensitive login details, which are then captured by threat actors for unauthorized account access or financial theft. Infrastructure analysis reveals multiple red flags confirming malicious intent. The domain was registered through MarkMonitor, Inc. on March 04, 2026, an unusually distant creation date suggesting potential domain spoofing or misuse of a legitimate registrar. It resolves to the IP address 104.18.36.248, hosted on Cloudflare’s network (AS13335), a common tactic to obscure the true origin of phishing infrastructure. Detection metrics further validate the threat: 20 out of 95 security vendors on VirusTotal flagged the domain as malicious, with one active blocklist entry confirming its phishing classification. If you visited logi-ndax-usa.webflow.io or entered credentials on the site, immediate action is required. First, revoke access to any associated cryptocurrency accounts by changing passwords and enabling multi-factor authentication on the legitimate NDAX platform. Monitor accounts for unauthorized transactions and report suspicious activity to the exchange’s support team. Additionally, scan your device for malware using updated security tools, as phishing sites may deploy additional payloads. Avoid interacting with any communications claiming to be from NDAX that reference this domain, as they may be part of follow-up social engineering attempts.