netcoins-logi--ca[.]webflow[.]io

This domain, netcoins-logi--ca.webflow.io, is flagged as a generic phishing site targeting users of the Netcoins cryptocurrency exchange. The page mimics the official Netcoins login portal, using the title 'Netcoins Log In | Official Account' to deceive victims into entering credentials. No specific drainer kit signatures were identified, but the domain follows common phishing infrastructure patterns, including the use of a legitimate-looking subdomain under a compromised or abused platform. Analysis indicates the domain was registered through Webflow on March 27, 2026, and resolves to the IP address 172.64.151.8, hosted by Cloudflare, Inc. in Canada. VirusTotal detection shows 20 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and is currently blocked by at least one threat intelligence feed. The SSL certificate is issued by Google Trust Services (WE1), which, while legitimate, is frequently exploited in phishing campaigns to appear trustworthy. As of the latest assessment, the domain has been taken offline, reducing immediate risk to users. However, the infrastructure remains a potential threat, as phishing domains often reappear under similar subdomains or IPs. Users who accessed the site should rotate credentials immediately and monitor for unauthorized transactions. Organizations are advised to block the domain and associated IP in perimeter defenses and verify no internal systems communicated with the address.