netcoinloginetwork[.]webflow[.]io

Analysis of netcoinloginetwork.webflow.io indicates a credential‑phishing infrastructure that impersonates the Netcoins brand. The domain was registered on May 08 2013 through MarkMonitor, Inc., and is currently hosted on Cloudflare (AS13335) with the address 104.18.36.248 located in the United States. DNS resolution uses the Cloudflare‑provided nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com. An SSL certificate issued by Google Trust Services (CN=WE1) secures the site, confirming the use of Google’s PKI.

The HTTP response returns a 403 status code, suggesting the content is not presently served, yet historical evidence shows the page title “Netcoins Login | Crypto Trading and Investing,” a clear brand‑impersonation cue. VirusTotal scans have flagged the domain in 16 of 93 security engines, and it is listed on one public security blocklist, currently blocked by PhishDestroy. Detected web technologies include Webflow, Google Hosted Libraries, Google Font API, Cloudflare, and HTTP/3, all consistent with the observed hosting profile. The scam classification is credential phishing, targeting users of the Netcoins platform to harvest login credentials.

Defenders should add the domain and its resolved IP to outbound‑traffic blocklists, enforce DNS‑level filtering for Cloudflare‑hosted phishing sites, and monitor for future re‑activation of the domain or similar Webflow‑based clones. Continuous review of threat‑intel feeds for additional detections is advised, as the offline status does not preclude re‑use. The combination of brand‑specific page title, registrar reputation, SSL provenance, and multi‑vendor detection provides strong evidence that the domain was employed for Netcoins‑related credential harvesting.