ndaxlogen[.]webflow[.]io

This domain is flagged for elevated risk due to brand impersonation targeting Ndax, a cryptocurrency exchange platform. Analysis indicates the site was designed to harvest user credentials by mimicking the official Ndax login interface, specifically replicating the page title 'NDAX Login: Manage Your Digital Assets Confidently.' The threat type is confirmed as credential theft through brand impersonation, not generic phishing or crypto drainer activity. Infrastructure analysis reveals the domain ndaxlogen.webflow.io was registered through NameCheap, Inc. on February 21, 2026, and resolves to IP address 172.64.151.8 (AS13335 Cloudflare, Inc., US). The SSL certificate is issued by Google Trust Services (WE1). VirusTotal reports 18 out of 95 security vendors flagging the domain, and it appears on one security blocklist. The domain was subsequently taken offline, though residual risk remains for users who may have interacted with it prior to deactivation. Mitigation steps specific to this threat type include immediate revocation of any credentials entered on the site, particularly for Ndax accounts. Users should enable multi-factor authentication on all cryptocurrency exchange accounts and verify domain authenticity before entering login details. Organizations should update web filters to block the domain and its associated IP address (172.64.151.8) to prevent accidental access. Security teams are advised to monitor for unusual login attempts or unauthorized transactions linked to Ndax accounts, as compromised credentials may still be exploited even after the domain is offline.