ndax-myacccount[.]webflow[.]io

Analysis of ndax-myacccount.webflow.io confirms active credential-phishing infrastructure impersonating Ndax, a Canadian cryptocurrency exchange. The domain was registered on February 21, 2026, through NameCheap, Inc., and currently resolves to 172.64.151.8 on Cloudflare’s network (AS13335). The page title, 'NDAX® | Login: Canada’s Most Secure Crypto Exchange,' explicitly targets Ndax users, aligning with the reported scam type of credential phishing. Infrastructure analysis reveals the use of Webflow for hosting, Cloudflare for DNS and CDN services, and HTTP/3 for transport, a common pattern in phishing campaigns leveraging reputable providers to evade detection. The SSL certificate, issued by Google Trust Services (WE1), appears valid, further masking malicious intent. Security vendors have flagged the domain, with 19 of 93 engines on VirusTotal detecting it as malicious, and it is currently blocked by at least one security blocklist. The domain remains active as of July 12, 2026, serving a high-risk threat to users attempting to access Ndax services. Defenders should prioritize blocking resolutions to 172.64.151.8, monitoring for related domains using the same Webflow and Cloudflare infrastructure, and alerting users to the credential-phishing risk. The exact content of the phishing page has not been analyzed, but the combination of brand impersonation, credential-phishing classification, and active security detections provides sufficient evidence for immediate mitigation.