SafeMode - Analysis: portal-ndax---io-cdn---auth-login.webflow.io

Captura Visual

Screenshot of portal-ndax---io-cdn---auth-login.webflow.io

Informações de Detecção

http://portal-ndax---io-cdn---auth-login.webflow.io/

Detected Brand

Ndax

Country

International

Confiança

95%

HTTP Status

200

Report ID

fda4123c-a6b…

Analyzed

2026-02-14 12:15

Final URL (after redirects)

https://portal-ndax---io-cdn---auth-login.webflow.io/

Hashes de Conteúdo (Similaridade HTML)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T14C818327F51CA46E4BC084F4A830B6ECD60F54CEE441CECDABE0C4AD56ED6D582F2A56
CONTENT ssdeep	96:SsRHIH6TP79ylw/FzxGcU2HxGcvtxGc1xGchxGcci5/IIFGmON1r:7RHIH6TPAwtzxLUixLvtxL1xLhxLcBQ4

Hashes Visuais (Similaridade de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	a9863b3c248fd8f2
VISUAL aHash	03036b03030b0303
VISUAL dHash	2fcbabd79793530b
VISUAL wHash	070f7b73434b8b83
VISUAL colorHash	31000400030
VISUAL cropResistant	74f474f474747473,e4f0b1b4c968b0e0,c4a2942b2bada2c2,32e594e98b896816

Análise de Código

Risk Score 53/100

Nível de Ameaça ALTO

⚠️ Phishing Confirmed

🎣 Credential Harvester

🔬 Threat Analysis Report

• Ameaça: Phishing
• Alvo: Usuários da Ndax
• Método: Falsificação via hospedagem gratuita.
• Exfil: Potencialmente através de formulários (se presentes).
• Indicadores: Hospedagem gratuita, logotipo da marca.
• Risco: Alto

🔒 Obfuscation Detected

fromCharCode

🎯 Kit Endpoints

https://portal.ndax.io/auth/login
https://portal-ndax---io-cdn---auth-login.webflow.io/

📊 Detalhamento da Pontuação de Risco

Total Risk Score

90/100

Contributing Factors

Free Hosting

The use of free hosting (Webflow.io) significantly raises the likelihood of phishing.

Brand Impersonation

The page mimics the branding of a legitimate platform (Ndax).

🔬 Análise Integral de Ameaças

Tipo de Ameaça

Credential Harvesting Kit

Alvo

Ndax users (International)

Método de Ataque

Brand impersonation + credential harvesting forms + obfuscated JavaScript

Canal de Exfiltração

Form submission (backend endpoint not detected - likely JavaScript-based)

Avaliação de Risco

MEDIUM - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

Kit types: Credential Harvester
4 obfuscation techniques

🏢 Análise de Falsificação de Marca

Impersonated Brand

Ndax

Official Website

ndax.com

Fake Service

Ndax login page/platform

⚔️ Metodologia de Ataque

Primary Method: Credential Harvesting

The attackers are likely trying to trick users into entering their login credentials into a fake form that looks like Ndax. Once the credentials are submitted, the attackers will have access to the user's account.