sso-ndax-nav-cdn-auth[.]webflow[.]io

The domain sso-ndax-nav-cdn-auth.webflow.io was registered on May 08, 2013 through MarkMonitor, Inc. and currently resolves to the IP address 104.18.36.248, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site is protected by an SSL certificate issued by Google Trust Services under the WE1 umbrella, indicating that HTTPS connections are terminated by Cloudflare’s edge infrastructure. Technical probes show the site serving HTTP/3 and returning an HTTP 404 status code with the page title "404 - Page not found." No additional content has been captured, and the exact nature of any phishing payload or impersonated brand remains unverified.

The domain appears on a single security blocklist, specifically PhishDestroy, and VirusTotal records indicate that 13 of 95 scanned security vendors flagged the domain as malicious. The current operational status is listed as offline, suggesting that the hosting service has been taken down or the site is no longer active. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑hosting attempts on other IP ranges, and consider adding the domain to internal threat‑intel feeds.

Since the site is hosted on Cloudflare, future iterations could leverage the same CDN for rapid redeployment, so vigilance on Cloudflare‑associated IP blocks is advised. Because the page content has not been publicly captured, analysts should treat the domain as a potential credential‑harvesting infrastructure pending further evidence, and prioritize verification of any related URLs that may appear in phishing campaigns.