netcoins-cdn-nav-cdn[.]webflow[.]io

The domain netcoins-cdn-nav-cdn.webflow.io has been identified as a generic phishing threat, impersonating the legitimate cryptocurrency platform NetCoins to steal user login credentials. While no specific drainer kit was detected, the page title 'Log In | NetCoins® | Sign In' clearly indicates credential harvesting intent. The domain was registered through NameCheap, Inc. and created on February 21, 2026, signaling a recent and active campaign.

Technical indicators are robust: VirusTotal shows 16 out of 95 security vendors flagging the domain as malicious, and it appears on at least 1 security blocklist. The domain resolves to IP address 172.64.151.8 and uses an SSL certificate issued by Google Trust Services (WE1). Notably, Google Safe Browsing (GSB) did not flag this domain in the provided data, but the high VT score suggests widespread detection. The combination of a newly registered domain, credential-themed title, and multiple vendor flags confirms the elevated risk.

As of the latest check, the domain is offline, indicating that hosting or registrar action has been taken to disrupt the phishing operation. However, users who may have accessed the site before takedown should change their NetCoins passwords immediately and enable two-factor authentication. PhishDestroy recommends monitoring accounts for unauthorized activity and reporting any suspicious interactions to NetCoins support. No remaining risk beyond prior exposure is noted, but vigilance is advised as similar domains may reappear.