sso-ca-netcoins-com-aauth[.]webflow[.]io

PhishDestroy identifies sso-ca-netcoins-com-aauth.webflow.io as an active credential theft domain masquerading as a legitimate Netcoins Single Sign-On portal. This site leverages Webflow.io hosting to mimic official authentication pages, tricking users into surrendering login credentials under the guise of secure access. The threat actor behind this campaign likely aims to harvest cryptocurrency exchange credentials for subsequent account takeover and fund draining operations.

Technical analysis confirms elevated risk factors: VirusTotal detection stands at 19 out of 95 security vendors, while the domain resolves to IP 172.64.151.8 through Cloudflare infrastructure. Notably, the SSL certificate issued by Google Trust Services adds superficial legitimacy that could bypass basic user scrutiny. The domain itself, hosted on Webflow's platform, employs a naming convention (sso-ca-netcoins-com-aauth) designed to exploit Netcoins brand recognition through misleading subdomain structure.

Users who may have accessed this domain should immediately change their Netcoins account passwords using a separate, secure device. Enable two-factor authentication on the legitimate Netcoins platform and review accounts for any unauthorized transactions. Consider revoking any API keys or withdrawal permissions that might have been exposed. Report the incident to Netcoins support while avoiding any further interaction with this domain. Security teams should block the domain at network level and investigate potential lateral movement if credentials were reused across systems.