ndaxio-en[.]wixstudio[.]com

This domain, ndaxio-en.wixstudio.com, is identified as a high-risk phishing site designed to impersonate the legitimate cryptocurrency exchange Ndax. Analysis indicates the site presents a fraudulent login interface, mimicking the authentic Ndax sign-in portal with the page title 'Log In || Ndax® - Sign In.' The threat type is classified as a fake login page, likely intended to harvest user credentials for unauthorized account access or subsequent crypto asset theft. No direct evidence of a crypto drainer kit was observed, but the infrastructure aligns with credential-harvesting phishing campaigns targeting financial platforms. Infrastructure analysis reveals the following technical indicators: the domain is flagged by 12 out of 95 security vendors on VirusTotal, indicating broad detection across multiple threat intelligence sources. It is registered through GoDaddy.com, LLC, and resolves to the IP address 34.144.206.118, hosted on a platform associated with Wix Studio. The SSL certificate is issued by Let's Encrypt, a common but not exclusive indicator of legitimate domains. The domain appears on three security blocklists, including PhishDestroy, PhishingArmy, and OISD, further corroborating its malicious classification. No creation date was provided, but the rapid inclusion on blocklists suggests recent deployment. Google Safe Browsing (GSB) status is not explicitly stated, though the domain's presence on multiple blocklists implies likely prior flagging. The domain is currently offline, reducing immediate risk to end users. However, historical activity and infrastructure reuse remain a concern. Response actions by hosting providers or registrars appear to have resulted in takedown, though no specific enforcement details are available. Remaining risk includes potential re-registration under a similar domain or migration to alternative hosting infrastructure. Users are advised to verify domain authenticity before entering credentials, enable multi-factor authentication on financial accounts, and cross-reference official exchange URLs. Organizations should monitor for related domains using the same IP or registrar patterns to preemptively block emerging threats.