nadx-us-en[.]addpotion[.]com

The domain nadx-us-en.addpotion.com was identified as a brand‑impersonation infrastructure targeting the cryptocurrency exchange Ndax. Registration records show the domain was created on 27 October 2021 through NameCheap, Inc. The authoritative nameservers are ns1.vercel-dns.com and ns2.vercel-dns.com, indicating the site was hosted on Vercel’s platform. Network resolution points to IP address 216.150.1.1, which belongs to Amazon.com, Inc. (AS16509) and is geolocated to the United States. An SSL certificate issued by Let’s Encrypt (R13) secures the domain, and HTTP responses return a 404 status code, suggesting the site is currently offline or the content has been removed.

Detection data reveal that 16 of 95 security vendors on VirusTotal flagged the domain, and it appears on at least one public security blocklist. The site is also listed as blocked by PhishDestroy. Automated analysis detected the use of Vercel services and HTTP Strict Transport Security (HSTS) headers. The page title reported by crawlers is simply “nadx,” providing no additional context about the page’s purpose.

The available evidence confirms the domain’s intent to impersonate Ndax, but the exact content that was served before takedown cannot be verified from the current data set. Because the domain is offline, immediate risk to end users is reduced; however, the infrastructure components—namely the Vercel hosting environment and the Amazon‑owned IP address—could be reused for future campaigns. Organizations should continue to monitor DNS queries for the domain and related subdomains, block the IP address at perimeter defenses, and add nadx-us-en.addpotion.com to internal deny lists. Incident response teams should also review any recent authentication attempts or credential submissions that reference Ndax to determine if victims may have interacted with the site before it was taken down.