netcoins-login-sso-ca-x[.]webflow[.]io

This domain, netcoins-login-sso-ca-x.webflow.io, is identified as a credential phishing site impersonating Netcoins, a cryptocurrency exchange platform. Analysis indicates the page presents a fraudulent login interface designed to harvest user credentials, specifically targeting customers of the legitimate Netcoins service. No direct evidence of a crypto drainer kit was observed, but the domain exhibits characteristics consistent with brand impersonation and credential theft operations. Infrastructure analysis reveals the domain was registered through Webflow and resolves to IP address 172.64.151.8, hosted on Cloudflare infrastructure (AS13335). The domain is flagged by 19 out of 95 security vendors on VirusTotal, indicating a moderate level of detection. It appears on one security blocklist and is currently blocked by at least one anti-phishing system. The SSL certificate is issued by Google Trust Services (WE1), a common practice among phishing sites to appear legitimate. No creation date was provided, but the domain is now offline, suggesting takedown or abandonment. Current status of the domain is offline, reducing immediate risk to users. However, residual risk remains due to potential credential exposure from earlier interactions. Users who accessed the site prior to takedown should assume credentials were compromised and initiate password resets on the legitimate Netcoins platform. Organizations are advised to monitor for unauthorized access attempts using harvested credentials and update blocklists to include this domain and associated IP address. Continuous vigilance is recommended as threat actors may re-establish phishing infrastructure under similar domains.