# en-sso-netcoins-com-cdn-oauth.webflow.io — MALICIOUS

> PhishDestroy identifies en-sso-netcoins-com-cdn-oauth.webflow.io as a fake OAuth login phishing page hosted on 104.18.36.248. Check the full report.

## Summary
PhishDestroy identifies en-sso-netcoins-com-cdn-oauth.webflow.io as a counterfeit OAuth login page designed to steal cryptocurrency credentials and session tokens. The site mimics legitimate authentication flows, tricking visitors into entering their Google or exchange credentials under the guise of a ‘network coin’ wallet service. Once submitted, harvested credentials are sent to attacker-controlled servers, enabling unauthorized access to real accounts and digital assets. This is not just another phishing domain—it is a targeted credential harvesting operation masquerading as a wallet authentication portal.

This domain was flagged by 19 out of 95 VirusTotal security vendors, indicating elevated risk and widespread suspicion. It resolves to IP address 104.18.36.248 and uses a Google Trust Services SSL certificate to appear legitimate. The threat actor leverages the webflow.io subdomain to host a spoofed OAuth consent screen, exploiting user trust in major cloud platforms. The low detection rate suggests this campaign is either new or highly targeted, avoiding broad signature-based detection.

If you visited en-sso-netcoins-com-cdn-oauth.webflow.io, immediately revoke any permissions you may have granted and change your passwords on all linked accounts—especially cryptocurrency exchanges and Google. Do not trust browser-stored tokens or saved sessions. Run a full antivirus scan, clear browser cookies, and consider enabling multi-factor authentication via hardware keys. Report the site to Google Safe Browsing and your email provider to help block further access. Avoid interacting with any links or login prompts from this domain—it is a confirmed malicious impersonation site.

## Threat Details
- Verdict: MALICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: REGISTRAR_NOT_FOUND
- IP: 104.18.36.248

## Detection Status
- VirusTotal: 19 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/1172c34a-7d9b-4574-985a-49beb316690e
- PhishDestroy: https://phishdestroy.io/domain/en-sso-netcoins-com-cdn-oauth.webflow.io/
- LLM endpoint: https://phishdestroy.io/domain/en-sso-netcoins-com-cdn-oauth.webflow.io/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/en-sso-netcoins-com-cdn-oauth.webflow.io/
Last updated: 2026-03-21