sso-ca-netcoins-com-ca-auth[.]webflow[.]io

This domain, sso-ca-netcoins-com-ca-auth.webflow.io, is identified as a generic phishing site impersonating the Netcoins cryptocurrency exchange login portal. The page title, 'Netcoins | Login,' directly mimics the legitimate authentication interface, suggesting an intent to harvest user credentials. No explicit crypto drainer kit signatures were detected, but the domain aligns with credential theft tactics targeting financial platforms. Analysis indicates the domain resolves to IP address 104.18.36.248, hosted on infrastructure associated with Cloudflare, Inc. in Canada. VirusTotal reports 17 out of 95 security vendors flagging the domain as malicious. The domain is registered through Webflow, a platform commonly abused for rapid deployment of phishing pages. It appears on one security blocklist, and its SSL certificate is issued by Google Trust Services (WE1). No creation date is available, but the domain is currently offline, likely following takedown actions. The domain was taken offline, reducing immediate risk, though residual threats persist. Users who interacted with the site may remain vulnerable to credential reuse attacks. Infrastructure analysis reveals the use of Content Delivery Network (CDN) obfuscation, a common tactic to evade detection. Organizations should monitor for credential-stuffing attempts and enforce multi-factor authentication (MFA) for all financial accounts. No further malicious activity has been observed post-takedown, but similar domains may emerge using identical infrastructure.