portal-ndx-io-loggin[.]webflow[.]io

The domain portal-ndx-io-loggin.webflow.io was registered on May 02, 2026 and resolves to the Cloudflare‑owned address 104.18.36.248, which geolocates to Canada. The site serves content over HTTPS using a Google Trust Services / WE1 certificate and advertises Webflow, Cloudflare and HTTP/3 in its technology stack. HTTP requests return a 200 status code and the page title reads "NDAX® | Login: Trusted Canadian Crypto Exchange," indicating a fake‑exchange lure targeting users of the legitimate NDAX platform. Threat intelligence classifies the site as a generic phishing operation with a high risk rating; it is listed on one security blocklist and has been actively blocked by PhishDestroy. Reputation metrics are extremely low, with Gridinsoft assigning a 0/100 trust score and Scamadviser a 1/100 score. VirusTotal analysis shows that 18 of 91 scanning engines flag the domain as malicious. While the underlying infrastructure—Webflow hosting behind Cloudflare—does not itself imply malicious intent, the combination of brand impersonation, low reputation scores, and multiple vendor detections confirms a credential‑ harvesting campaign. Defenders should add the fully qualified domain to outbound filtering rules, monitor DNS queries for the domain and its associated IP, and ensure that any credential‑capture attempts against NDAX are logged and investigated. Continuous threat‑feed updates are recommended to capture any future re‑hosting or domain‑generation attempts related to this campaign.