logoin-ndax-ca[.]webflow[.]io

This domain, logoin-ndax-ca.webflow.io, is a confirmed crypto-focused phishing site designed to impersonate the login portal of a legitimate Canadian cryptocurrency exchange. Analysis indicates the page replicates the branding, layout, and authentication workflow of the targeted platform, tricking users into submitting sensitive credentials such as usernames, passwords, and two-factor authentication codes. The threat extends beyond credential theft, as stolen login details could enable unauthorized access to digital wallets, leading to financial loss or further exploitation through social engineering attacks targeting the victim’s contacts or associated accounts. Evidence supporting the malicious classification includes detection by 18 out of 95 security vendors on VirusTotal, with the domain appearing on one active blocklist. Infrastructure analysis reveals the domain was registered through Webflow on March 14, 2026, an anomalous creation date suggesting potential domain spoofing or typosquatting. The site resolves to IP address 172.64.151.8, hosted on AS13335 (Cloudflare, Inc.), and uses an SSL certificate issued by Google Trust Services (WE1). The page title, "NDAX® | Login: Canada’s Most Secure Crypto Exchange," directly mimics the legitimate platform, reinforcing the phishing intent. Users who visited logoin-ndax-ca.webflow.io should assume their credentials were compromised. Immediate actions include revoking access to any accounts linked to the submitted information, enabling multi-factor authentication on all critical services, and monitoring for unauthorized transactions or login attempts. If financial details were entered, affected parties should report the incident to their financial institution and relevant cybersecurity authorities. Additionally, clearing browser cache and running a full antivirus scan is recommended to mitigate potential secondary infections from embedded malicious scripts or redirects.