netcoins--logi--cdn--go[.]webflow[.]io

The domain netcoins--logi--cdn--go.webflow.io, flagged by 14 out of 93 VirusTotal vendors, is a credential phishing site that mimics the Netcoins login page. Despite its current offline status, it previously posed a threat by attempting to steal user credentials under the guise of a legitimate digital asset trading platform.

Registered through NameCheap, Inc., the domain was hosted on an IP address managed by Cloudflare, Inc. in the United States. The SSL certificate was issued by Google Trust Services, adding a layer of perceived legitimacy to unsuspecting users. PhishDestroy identified this threat on February 20, 2026, a day before its official registration date, highlighting the proactive measures in place to detect such threats early.

The domain's takedown reduces its immediate threat, but its prior activity underscores the persistent risk of phishing attacks exploiting brand trust. The use of a well-known registrar and a reputable SSL issuer are tactics designed to bypass initial suspicion and enhance the site's credibility. This case exemplifies the need for continuous vigilance and rapid response to newly registered domains that may engage in malicious activities.