app-new-neetcoins[.]webflow[.]io

The domain app-new-neetcoins.webflow.io was created on March 17, 2026 and is hosted on the Webflow platform using Cloudflare services. DNS resolution points to IP address 104.18.36.248, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presents a page title of "Netcoins Login | Netcoins," indicating a credential phishing attempt targeting users of the Netcoins service. Technical analysis shows the presence of Webflow, Cloudflare, and HTTP/3 in the service stack, while the SSL certificate is identified as WE1. An HTTP request to the host returns a 403 status code, reflecting denied access at the time of observation.

Gridinsoft assigns a trust score of 0 out of 100, the lowest possible rating. VirusTotal analysis records 18 detections out of 94 security vendors, confirming that multiple scanners flag the domain as malicious. The domain appears on a single security blocklist and has been actively blocked by PhishDestroy. Nameserver information is unavailable (NS_NOT_FOUND).

Registration was performed through Webflow, and the current operational status is offline, suggesting that the phishing page has been taken down or is otherwise inaccessible. While the available data confirms a credential phishing campaign, no additional payloads, redirects, or post‑compromise activity have been observed. Defenders should continue to block the domain at network perimeters, update URL filtering rules to include the host, and monitor for any re‑registration or similar subdomains that reuse the same brand targeting patterns. Ongoing surveillance of the associated IP range and Cloudflare‑hosted assets is advised, as adversaries often recycle infrastructure for future campaigns.