sso--my-netcoin-com-cdn-ca-y-oauths[.]webflow[.]io

This domain, sso--my-netcoin-com-cdn-ca-y-oauths.webflow.io, is identified as a credential theft operation targeting cryptocurrency users through brand impersonation. Analysis indicates the site mimics the legitimate Netcoins platform, a known cryptocurrency exchange, to harvest login credentials. The page title, 'Log In | Netcoins® - Buy & sell crypto | Official Website,' reinforces the deception by presenting itself as the authentic portal. No explicit crypto drainer kit signatures were detected, but the focus on credential collection suggests subsequent unauthorized access to user wallets or accounts.

Technical indicators confirm elevated risk: the domain is flagged by 19 of 95 security vendors on VirusTotal, registered through MarkMonitor, Inc. on March 6, 2026, and resolves to IP 104.18.36.248 (AS13335, Cloudflare, Inc.). The SSL certificate is issued by Google Trust Services (WE1), a common tactic to appear legitimate. The domain appears on one security blocklist and was blocked by at least one anti-phishing feed. Infrastructure analysis reveals the use of Cloudflare’s network, which is frequently leveraged to obscure hosting origins and evade takedowns.

As of the latest assessment, the domain has been taken offline, reducing immediate exposure. However, residual risk persists due to potential credential reuse by victims and the possibility of the threat actor re-deploying the infrastructure under a new domain. Users who interacted with this site are advised to reset credentials for any associated accounts, enable multi-factor authentication, and monitor for unauthorized transactions. Organizations should update blocklists to include this domain and its resolved IP, while security teams should investigate logs for connections to 104.18.36.248 during the active period.