logi-ndex[.]webflow[.]io

logi-ndex.webflow.io is a brand impersonation phishing page targeting Ndax users by presenting a fraudulent login interface designed to harvest cryptocurrency exchange credentials. The infrastructure mimics a legitimate authentication portal, using a misleading page title referencing Ndax login services to increase user trust and induce credential entry. The domain is currently offline, indicating takedown or hosting removal after detection.

Technical analysis shows the domain was created on February 21, 2026 and registered through NameCheap, Inc. It resolves to IP 172.64.151.8 operated under US-based Cloudflare, Inc. infrastructure (AS13335). Detection systems report it was flagged by 18 of 95 VirusTotal security vendors and appears on 1 security blocklist, with blocking enforced by PhishDestroy. SSL issuance is attributed to Google Trust Services (WE1), indicating use of automated certificate provisioning commonly seen in rapidly deployed phishing environments.

Despite current inactivity, the domain represents elevated residual risk due to its prior hosting of credential harvesting content and impersonation of a financial platform. Users who interacted with the site should assume sensitive credentials may have been compromised and should immediately reset passwords, revoke active sessions, and enable multi-factor authentication on associated accounts. Security teams should monitor for similar Webflow-hosted subdomain abuse, as this infrastructure pattern is frequently reused for short-lived phishing campaigns.