netcoins-logiii[.]webflow[.]io

Analysis of netcoins‑logiii.webflow.io shows an active credential‑phishing site that mimics the Netcoins brand. The page title “Netcoins Login – Crypto Investing Made Easy” is served over HTTPS with a Google Trust Services certificate (WE1) and returns HTTP 200. The domain was registered on 11 May 2026 through Webflow and resolves to Cloudflare‑owned IP 104.18.36.248 located in Canada. Threat‑intelligence feeds list the site on a single blocklist and note that PhishDestroy has already blocked it. Reputation services rate the host poorly, with Gridinsoft assigning a trust score of 0 / 100 and 19 of 92 VirusTotal scanners flagging the domain. The infrastructure indicates reliance on a shared CDN, typical of low‑cost phishing deployments. While the exact phishing kit is not disclosed, the combination of brand impersonation, a convincing login‑oriented title, and a low‑reputation score suggests an attempt to harvest Netcoins user credentials. Defenders should add the domain to web‑filter block lists, monitor DNS queries for the host, and enforce multi‑factor authentication for Netcoins accounts. Further investigation of traffic to the IP may reveal additional malicious payloads, and any observed credential submissions should be treated as compromised.