official---netcoins-ca-com-sso[.]webflow[.]io

This domain, official---netcoins-ca-com-sso.webflow.io, is actively impersonating Netcoins, a cryptocurrency exchange, as indicated by its page title 'Netcoins Login' and classification as a credential phishing site. Registered on February 19, 2026, through Webflow, the domain resolves to IP address 104.18.36.248, hosted on Cloudflare infrastructure (AS13335) in Canada. The site employs HTTP/3 and is proxied via Cloudflare, which obscures direct server attribution. Analysis reveals a valid SSL certificate issued by Google Trust Services (WE1), a common tactic to appear legitimate. The domain is flagged by 16 of 91 security vendors on VirusTotal and is currently blocked by at least one security provider, though it remains operational as of July 12, 2026. Defenders should note that the domain's use of Webflow, a legitimate website builder, may complicate detection efforts, as such platforms are frequently abused for phishing due to their ease of use and built-in hosting. The combination of Cloudflare proxying and a valid SSL certificate further reduces visibility into the attacker's origin. While the exact content of the phishing page is not yet analyzed, the presence of a login-themed page title strongly suggests credential harvesting targeting Netcoins users. The domain's creation date (five months prior to this report) indicates it may have been prepared in advance for a phishing campaign. Recommended actions include immediate blocking of the domain and its resolving IP at the network level, monitoring for related subdomains or similarly named Webflow-hosted domains, and alerting users to potential credential theft attempts. Given the domain's active status and high-risk classification, defenders should prioritize containment and investigate any potential compromise of credentials submitted to this site.