help-ndex-logen[.]webflow[.]io

This domain, help-ndex-logen.webflow.io, operates as a cryptocurrency phishing site designed to harvest login credentials by impersonating a legitimate Canadian crypto exchange. The page mimics the branding and interface of the authentic platform, presenting a fraudulent login portal labeled 'NDAX® | Login: Canada’s Most Secure Crypto Exchange.' Users entering credentials on this site risk unauthorized access to their digital assets, financial theft, and potential follow-up attacks such as account takeovers or malware distribution via compromised accounts. Analysis indicates the domain is hosted on infrastructure associated with Webflow, resolving to IP address 172.64.151.8, and protected by Cloudflare services. The SSL certificate is issued by Google Trust Services, a common tactic to lend false legitimacy. Security vendors on VirusTotal flagged the domain as malicious, with 19 out of 95 engines detecting it as phishing. The domain appears on one security blocklist, and its Gridinsoft trust score is 0/100, indicating high confidence in its malicious nature. Technologies detected include Webflow for hosting, Cloudflare for CDN and security, and HTTP/3 for network communication, which are frequently leveraged by threat actors to evade detection and enhance scalability. Users who visited help-ndex-logen.webflow.io should immediately revoke any entered credentials from associated crypto exchange accounts. Monitor financial accounts for unauthorized transactions and enable multi-factor authentication (MFA) on all related platforms. Clear browser cache and cookies to remove any residual session data. If credentials were submitted, assume compromise and rotate passwords for all accounts sharing the same or similar login details. Report the incident to the legitimate exchange and relevant cybersecurity authorities to aid in mitigation efforts.