portal-app-ndax--io-cdn--v[.]webflow[.]io

This domain, portal-app-ndax--io-cdn--v.webflow.io, operates as a credential harvesting site specifically designed to impersonate Ndax, a Canadian cryptocurrency exchange. The phishing page replicates the legitimate Ndax login interface, including the page title 'NDAX Login – Canada's Trusted Crypto Exchange,' to deceive users into entering their account credentials. Infrastructure analysis reveals the site was crafted to exploit trust in the Ndax brand, potentially leading to unauthorized access to user funds and personal data. Evidence supporting this assessment includes detection by 18 out of 95 security vendors on VirusTotal, indicating widespread recognition of its malicious nature. The domain was registered through NameCheap, Inc. on February 21, 2026, and is hosted on a Cloudflare IP (172.64.151.8) located in the United States. It appears on at least one security blocklist, further confirming its classification as a phishing threat. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as phishing sites frequently use valid certificates to appear legitimate. Users who visited this domain should immediately change their Ndax account credentials, particularly if they entered login details. Enable multi-factor authentication (MFA) on all financial and cryptocurrency accounts to prevent unauthorized access. Monitor account activity for suspicious transactions and report any anomalies to the legitimate exchange. If financial data was entered, consider placing a fraud alert with relevant credit agencies. The domain is currently offline, but users should remain vigilant for similar phishing attempts targeting cryptocurrency platforms.