# secure--en--netcoins-com--cdn-auth.webflow.io — MALICIOUS

> PhishDestroy detects this fake NetCoins login page stealing credentials. VT flags 20 vendors and the page title mirrors the real site.

## Summary
PhishDestroy identifies secure--en--netcoins-com--cdn-auth.webflow.io as a live credential-phishing page masquerading as the genuine NetCoins exchange login. This site’s exact page title, Log In | NetCoins, deceives visitors into entering their email and password, sending credentials to attackers instead of the exchange. 20 out of 95 VirusTotal security vendors flag the domain, and its current SSL certificate (Google Trust Services) provides a false veneer of legitimacy.  This domain was flagged by PhishDestroy after analysis and is still active. The page resolves to IP 172.64.151.8 and the page title perfectly replicates the real NetCoins login page to trick users. Investigation shows the resource is hosted on webflow.io, a legitimate platform abused for phishing. The high-risk profile is driven by the active theft of login credentials paired with the absence of any two-factor authentication prompt. Attackers can immediately leverage stolen credentials for account takeover and cryptocurrency transfers.  If you visited this page and entered any information, immediately change your NetCoins password on the official site and enable two-factor authentication. Revoke any active API keys or session tokens via your NetCoins account settings. Run a malware scan and monitor your email and crypto wallets for unauthorized activity. Report the domain to your email provider and browser for blocking. To verify future links, manually type netcoins.com or use official app links rather than clicking advertisements or third-party URLs.

## Threat Details
- Verdict: MALICIOUS
- Site status: alive (HTTP ?)
- Page title: Log In | NetCoins

## Domain Intelligence
- Registrar: REGISTRAR_NOT_FOUND
- IP: 172.64.151.8

## Detection Status
- VirusTotal: 20 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/6e42e2a1-916f-4651-8179-b6c7dadee423
- PhishDestroy: https://phishdestroy.io/domain/secure--en--netcoins-com--cdn-auth.webflow.io/
- LLM endpoint: https://phishdestroy.io/domain/secure--en--netcoins-com--cdn-auth.webflow.io/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/secure--en--netcoins-com--cdn-auth.webflow.io/
Last updated: 2026-04-13