welcome-ndaxx-webs-app[.]typedream[.]app

The domain welcome-ndaxx-webs-app.typedream.app has been identified as a phishing resource specifically designed to impersonate NDAX, a Canadian cryptocurrency exchange platform. Analysis indicates this is a credential harvesting operation targeting users attempting to access the legitimate NDAX login portal. The page replicates the authentic NDAX interface, including the title 'NDAX® | Login | Canada’s Most Secure Crypto Exchange,' to deceive visitors into submitting sensitive account credentials. Infrastructure analysis reveals the domain was registered through Typedream, a platform typically used for website creation, and resolves to the IP address 188.114.97.3, which is associated with Cloudflare, Inc. and geolocated in Canada. Security vendor detection on VirusTotal shows 21 of 95 engines flagging the domain as malicious, while it appears on one security blocklist. The domain's hosting provider and registrar combination, along with its Cloudflare proxy usage, aligns with common phishing infrastructure patterns observed in credential theft campaigns. As of the latest verification, the domain has been taken offline, though residual risk remains for users who may have interacted with it prior to deactivation. Organizations and individuals are advised to monitor for unauthorized access attempts on cryptocurrency accounts, particularly those associated with NDAX. Network administrators should update blocklists to include the domain and its resolving IP, while users should verify the authenticity of any login portal by cross-referencing the URL with the official exchange domain. Multi-factor authentication and browser-based security extensions are recommended to mitigate similar threats.