portal-sso---ndax-cdn-nav-r---oauth[.]webflow[.]io

This report details a credential phishing threat targeting users of the cryptocurrency exchange Ndax. The domain portal-sso---ndax-cdn-nav-r---oauth.webflow.io hosted a fraudulent login page titled "NDAX® | Login | Canada’s Most Secure Crypto Exchange*" designed to impersonate the legitimate Ndax brand. The primary threat is the theft of user credentials, including usernames and passwords, which could lead to unauthorized access to victims' cryptocurrency accounts.

Technical analysis confirms the malicious nature of the site. VirusTotal flagged it with 18 detections out of 95 security vendors. Specific blocklisting entities include ADMINUSLabs, alphaMountain.ai, BitDefender, CyRadar, and ESET. The domain was registered with NameCheap, Inc. on 2026-02-21 and resolves to IP address 172.64.151.8, hosted in the United States under AS13335 (Cloudflare, Inc.). The site used an SSL certificate issued by Google Trust Services / WE1, which is typical for legitimate services but does not indicate safety.

The domain is currently reported as DOWN/OFFLINE, indicating the phishing site is no longer accessible. The risk level is assessed as high based on the specific impersonation of a financial service, the number of security vendor detections, and the use of a newly registered domain. Users who may have interacted with this site should change their Ndax account credentials immediately.