sso--ndax-ca--io[.]webflow[.]io

This domain, sso--ndax-ca--io.webflow.io, poses a significant threat as a credential theft operation targeting users of the legitimate Canadian cryptocurrency exchange NDAX. The site mimics the official NDAX login portal, using an identical page title, NDAX® | Login: Canada’s Most Secure Crypto Exchange, to deceive visitors into entering their account credentials. Once submitted, these credentials are harvested by threat actors, granting unauthorized access to victims' crypto wallets and personal data. The risk extends beyond account compromise, as stolen credentials are often reused across platforms, amplifying the potential for financial loss and identity theft. Analysis indicates this domain is a confirmed impersonation scheme with multiple technical red flags. It is flagged by 15 out of 95 security vendors on VirusTotal, a clear indicator of malicious activity. The domain was registered through Webflow, a platform frequently abused for hosting phishing sites due to its ease of deployment and free SSL certificates. Infrastructure analysis reveals the site resolved to IP address 104.18.36.248, a Cloudflare-hosted endpoint commonly associated with malicious domains leveraging CDN services to obscure their true origin. The SSL certificate, issued by Google Trust Services, further complicates detection, as it lends an appearance of legitimacy despite the domain's fraudulent purpose. If you visited sso--ndax-ca--io.webflow.io or entered any credentials on this site, immediate action is required to mitigate risk. First, cease all interaction with the domain and avoid clicking any links or downloading files from it. Change the passwords for your NDAX account and any other platforms where the same credentials were used, prioritizing accounts with financial or sensitive data. Enable multi-factor authentication (MFA) on all critical accounts to add an additional layer of security. Monitor your NDAX account and connected bank or crypto wallets for unauthorized transactions, and report any suspicious activity to the legitimate exchange. Finally, consider running a full security scan on your device to detect potential malware or keyloggers that may have been installed during the visit.