sso-ndax-lginapp-cdn[.]webflow[.]io

This domain is actively engaged in crypto credential theft, specifically targeting users of the legitimate NDAX cryptocurrency exchange platform. Analysis indicates the infrastructure is designed to harvest login credentials, potentially enabling unauthorized access to user accounts and subsequent theft of digital assets. The page title, 'NDAX® | Login: Canada’s Most Secure Crypto Exchange,' directly mirrors the branding of the authentic exchange, increasing the likelihood of successful deception among users seeking to access their accounts. Infrastructure analysis reveals multiple high-confidence threat indicators. The domain, registered through Webflow, resolves to the IP address 104.18.36.248 and is currently flagged by 15 out of 95 security vendors on VirusTotal. Additionally, the domain appears on one security blocklist, further corroborating its malicious intent. While the exact creation date of the domain is not publicly disclosed, the combination of brand impersonation, active status, and vendor detections strongly suggests a recently deployed phishing operation. Users who have visited this domain or entered credentials should take immediate action to mitigate potential risks. First, revoke any active sessions on the legitimate NDAX platform and reset account passwords using a secure, unrelated device. Enable multi-factor authentication if not already active, and monitor all linked accounts for unauthorized transactions or suspicious activity. If financial loss is suspected, report the incident to relevant authorities and the legitimate exchange to initiate fraud response protocols. Given the high-risk nature of this threat, affected users should also consider scanning their devices for malware or unauthorized access tools.