pro-ndax-page-login[.]webflow[.]io

This domain, pro-ndax-page-login.webflow.io, poses a direct threat of crypto credential theft through brand impersonation of NDAX, a Canadian cryptocurrency exchange. Analysis indicates the site mimics the legitimate NDAX login interface, using the page title 'NDAX® | Login: Canada’s Most Secure Crypto Exchange' to deceive users into submitting account credentials. Such stolen credentials are typically exploited for unauthorized access to cryptocurrency wallets, leading to asset theft or further compromise of linked financial accounts. Infrastructure analysis reveals the domain was registered through Webflow and resolves to the IP address 104.18.36.248, hosted on Cloudflare’s network (AS13335). Detection metrics confirm elevated risk: 19 out of 95 security vendors on VirusTotal flagged the domain as malicious, while one security blocklist has already listed it. The domain’s current status is offline, though prior activity may have exposed visitors to credential harvesting attempts. Users who accessed pro-ndax-page-login.webflow.io should immediately revoke any entered credentials by resetting passwords on the legitimate NDAX platform. Enable multi-factor authentication (MFA) on all cryptocurrency accounts to mitigate unauthorized access. Monitor linked financial accounts for suspicious transactions and report any anomalies to the legitimate service provider. If credentials were reused across other platforms, reset those passwords as well to prevent cross-service compromise. No further interaction with the domain should occur, and any local copies of the page should be deleted.