netcoins-logi--x-ca[.]webflow[.]io

This domain, netcoins-logi--x-ca.webflow.io, is identified as a credential harvesting phishing site designed to impersonate Netcoins, a cryptocurrency exchange platform. The site presents a fraudulent login interface to deceive users into submitting sensitive account credentials. As of the latest analysis, the domain has been taken offline, but prior activity indicates a targeted effort to capture authentication details for financial gain or unauthorized account access. Infrastructure analysis reveals the domain was registered on March 27, 2026, through Webflow, a legitimate platform often abused for hosting phishing content. It resolves to the IP address 172.64.151.8, geolocated to Canada and associated with Cloudflare, Inc. The domain’s SSL certificate is issued by Google Trust Services (WE1), a common attribute in both legitimate and malicious sites. Security vendors on VirusTotal flagged the domain, with 16 of 95 engines detecting it as malicious. Additionally, it appears on one security blocklist and was previously blocked by PhishDestroy, further confirming its malicious classification. The domain is currently offline, reducing immediate risk to users. However, organizations and individuals should remain vigilant, as similar infrastructure may re-emerge under different domains. It is recommended to monitor for newly registered domains mimicking Netcoins or other financial platforms, particularly those hosted on third-party services like Webflow. Users who may have interacted with this domain should reset their credentials immediately and enable multi-factor authentication where available. Network administrators should update blocklists to include this domain and its associated IP address to prevent future access attempts.