make-my-ndaax[.]webflow[.]io

This domain, make-my-ndaax.webflow.io, is identified as a crypto credential theft operation designed to harvest wallet login details, seed phrases, or private keys. Victims are typically lured through fake airdrop promotions, fraudulent exchange interfaces, or impersonated DeFi platforms, where any entered credentials are immediately transmitted to threat actors. The site may also deploy malicious scripts to auto-drain connected wallets if users interact with on-page elements, a tactic commonly associated with crypto drainer schemes. Analysis indicates the domain was registered on March 03, 2026, through Webflow, an unusual timeline suggesting potential domain spoofing or backdated registration records. It resolves to the IP address 104.18.36.248, hosted on Cloudflare infrastructure (AS13335), which is frequently leveraged by threat actors to obscure origin servers and evade takedowns. The SSL certificate, issued by Google Trust Services (WE1), is valid and does not inherently indicate malicious activity, though it is commonly exploited to lend false legitimacy. Security vendors on VirusTotal flagged this domain at a ratio of 18 out of 95, with detection labels including credential phishing, crypto drainer, and brand impersonation. The domain appears on one security blocklist and is currently offline, though historical snapshots may still pose risks if cached or redistributed. If you visited make-my-ndaax.webflow.io or entered any sensitive information, immediate action is required. Disconnect the device from all networks and revoke any wallet or exchange authorizations granted during the session. Rotate passwords, seed phrases, and API keys for all associated accounts, prioritizing crypto wallets and financial platforms. Scan the device for malware using updated security tools, focusing on browser extensions or scripts that may persist after the site is offline. Monitor connected accounts for unauthorized transactions and report the incident to relevant platforms or security teams for further mitigation. Avoid reusing credentials across services, and verify domain authenticity before interacting with any crypto-related site in the future.