auth-netcoins-canada-sso[.]webflow[.]io

PhishDestroy identifies an active crypto-drainer phishing campaign targeting Netcoins Canada users. The domain auth-netcoins-canada-sso.webflow.io poses as a legitimate single sign-on portal but harvests credentials and drains cryptocurrency wallets. This site is designed to trick visitors into entering login details or connecting cryptocurrency wallets under false pretenses, with the ultimate goal of stealing funds. The threat is elevated due to its convincing impersonation of a regulated Canadian exchange and active distribution in phishing emails and social media messages. This domain was flagged by 17 out of 95 VirusTotal security vendors and resolves to IP address 104.18.36.248. The SSL certificate is issued by Google Trust Services, which adds a false sense of legitimacy. The domain is hosted on Webflow, a legitimate platform often abused by threat actors to create plausible-looking phishing pages quickly. The low detection rate among vendors suggests it is a relatively new campaign designed to evade early detection. The domain structure mimics official Netcoins SSO endpoints, increasing the likelihood of successful deception among users expecting to access their accounts. If you visited auth-netcoins-canada-sso.webflow.io, stop using any connected cryptocurrency wallets immediately. Disconnect any wallets or browser extensions linked during your visit. Do not enter any login credentials or personal information. Run a full antivirus scan on your device. Report the domain to Netcoins Canada and PhishDestroy for takedown. Enable two-factor authentication on all cryptocurrency exchange accounts. Always verify links by typing the official domain directly into your browser or using PhishDestroy’s link checker. Be cautious of shortened URLs or unexpected login prompts, especially in unsolicited messages.