ss-o-ndax-io[.]zapier[.]app

This domain, ss-o-ndax-io.zapier.app, is identified as a phishing infrastructure specifically designed to impersonate the Ndax cryptocurrency exchange platform. The threat type is classified as a credential harvesting portal, presenting a fake login interface to deceive users into submitting sensitive account details. As of the latest assessment, the domain has been taken offline, though prior activity remains a concern for retrospective analysis. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain was flagged by 18 of 95 security vendors on VirusTotal, reflecting broad detection across threat intelligence platforms. It was registered through Vercel Inc on March 27, 2026, an unusual creation date suggesting potential domain spoofing or backdating. The domain resolves to the IP address 64.239.123.193, hosted by Vercel, Inc in the United States. It appears on one security blocklist, specifically PhishDestroy, and uses a Let's Encrypt SSL certificate (R12) to lend a superficial appearance of legitimacy. The page title, 'Log In | Ndax® - Sign In,' precisely mirrors the branding of the authentic Ndax platform, enhancing its deceptive effectiveness. Current status confirms the domain is offline, though residual risk persists for users who may have interacted with it prior to takedown. Organizations and individuals are advised to review access logs for connections to 64.239.123.193 or the domain name, particularly from March 27 onward. Credential rotation is strongly recommended for any accounts exposed to this domain. Network-level blocking of the IP and domain should be implemented as a preventive measure. Additionally, monitoring for similar subdomain patterns under zapier.app or other cloud-based hosting services is advised, as threat actors frequently reuse infrastructure templates for phishing campaigns.