netcoinsz-login[.]webflow[.]io

This domain is flagged as a confirmed credential phishing site designed to harvest login credentials from Netcoins users. Analysis indicates the page specifically mimics the legitimate Netcoins login portal, presenting itself as the 'Official Site' to deceive victims into entering sensitive account information. The threat type is classified as credential phishing with brand impersonation, targeting cryptocurrency users through social engineering tactics. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain netcoinsz-login.webflow.io is registered through Webflow and currently resolves to IP address 104.18.36.248, associated with Cloudflare infrastructure in Canada. Security vendors have flagged this domain on VirusTotal, with 21 out of 95 engines detecting malicious activity. The site appears on one security blocklist (PhishDestroy) and presents a Google Trust Services SSL certificate (WE1), which is commonly observed in phishing campaigns to lend false legitimacy. The page title explicitly claims to be the 'Netcoins Login - Official Site', a clear indicator of brand impersonation. Mitigation against this specific threat type requires immediate action from both users and network administrators. Users who may have interacted with this domain should immediately reset their Netcoins account credentials from a secure device and enable multi-factor authentication. Network administrators should implement DNS-based blocking for netcoinsz-login.webflow.io and its resolving IP 104.18.36.248, while monitoring for any attempted connections to this infrastructure. Organizations should also consider implementing web filtering policies that block newly registered Webflow domains exhibiting brand impersonation characteristics. Given the elevated risk level and cryptocurrency targeting, financial institutions should be notified to monitor for fraudulent transactions originating from compromised accounts.