can-netcoins[.]webflow[.]io

This domain, can-netcoins.webflow.io, was registered on 15 February 2026 and is currently serving a Netcoins login page that mimics the legitimate service. The site returns HTTP 200 and presents the title “Netcoins Login | Netcoins”, indicating a credential‑phishing campaign targeting Netcoins users. The page is hosted on Webflow and fronted by Cloudflare, using HTTP/3 and a TLS certificate identified as WE1.

The hostname resolves to 172.64.151.8, an address owned by Cloudflare’s AS13335 network located in the United States. No independent nameserver records are visible, which is consistent with Webflow‑managed DNS. The presence of Cloudflare and HTTP/3 suggests the attacker is leveraging a reputable CDN to hide the origin and to benefit from performance optimizations that may aid in evading basic network‑level detection.

Reputation services assign extremely low scores: Gridinsoft 0/100 and Scamadviser 1/100, and the domain appears on a single security blocklist, currently PhishDestroy. VirusTotal analysis shows 19 of 95 scanners flag the domain, reinforcing the malicious classification. The combination of a convincing login façade, low trust scores, and multiple vendor detections supports a high‑risk credential‑phishing designation.

Defenders should block DNS resolution for can‑netcoins.webflow.io and any sub‑domains, enforce URL filtering for the Netcoins brand, and monitor outbound traffic for POST requests to this host. Email gateways should be tuned to detect messages that reference the Netcoins login page or contain the exact page title. Incident response teams should advise users to verify the URL of Netcoins login portals and to report any credential submissions to the legitimate service.