help-ndax[.]gitbook[.]io

Analysis of help-ndax.gitbook.io confirms it as an active phishing domain specifically targeting users of the Canadian cryptocurrency exchange NDAX. The domain, registered through Cloudflare, resolves to IP address 172.64.147.209 and presents a login page titled 'NDAX® | Login | Canada’s Most Secure Crypto,' directly mimicking the branding and positioning of the legitimate NDAX platform. This alignment with NDAX’s marketing language strongly indicates an intent to harvest credentials from users expecting to access their crypto accounts. Infrastructure analysis reveals the use of GitBook for hosting, a platform often leveraged for documentation but increasingly abused for phishing due to its low barrier to entry and association with legitimate projects. The domain is served via Google Cloud and protected by Cloudflare, which may obscure the true origin of the malicious content and complicate takedown efforts. The presence of HSTS and HTTP/3 further suggests an attempt to appear legitimate and secure, potentially increasing victim trust. The domain is flagged by 14 of 95 security vendors on VirusTotal, indicating broad recognition of its malicious nature. It also appears on at least one security blocklist, specifically PhishDestroy, and holds a Gridinsoft trust score of 0/100, reinforcing its classification as high-risk. The SSL certificate is issued by Google Trust Services, which, while not inherently suspicious, is consistent with the infrastructure used to lend credibility to the phishing site. As of July 12, 2026, the domain remains active, posing an ongoing threat to users who may mistake it for the legitimate NDAX login portal. Defenders should prioritize blocking this domain at the network level and alerting users to the risk of credential theft. Given the use of Cloudflare and GitBook, monitoring for similar patterns—such as newly registered GitBook subdomains mimicking financial services—may help identify additional phishing campaigns.