sso-eng---ca-netcoins-com-cdn--auth[.]webflow[.]io

This domain, sso-eng---ca-netcoins-com-cdn--auth.webflow.io, is a credential phishing site designed to deceive users into entering their login credentials for NetCoins, a cryptocurrency exchange platform. The site presents a fraudulent login interface titled 'Log In | NetCoins _ Sign In Your Account,' closely resembling the legitimate NetCoins authentication page. Unsuspecting users who input their credentials risk having their accounts compromised, leading to potential financial loss or unauthorized access to sensitive personal and financial information. Analysis indicates this domain is part of a phishing campaign targeting NetCoins users. The domain is flagged by 19 out of 95 security vendors on VirusTotal, confirming its malicious nature. It is registered through Webflow, a platform often exploited for hosting phishing pages due to its ease of use and free-tier availability. The domain resolves to the IP address 104.18.36.248, which is associated with Cloudflare, Inc., a common proxy service used to obscure the true origin of malicious infrastructure. Additionally, the domain appears on one security blocklist and is currently offline, suggesting takedown efforts or voluntary cessation of the campaign. Users who visited this domain and entered their credentials should take immediate action to secure their accounts. First, change the password for the affected NetCoins account and enable multi-factor authentication if not already active. Monitor the account for any unauthorized transactions or suspicious activity. If financial loss or unauthorized access is detected, report the incident to NetCoins support and relevant authorities. It is also advisable to scan the device used to access the phishing site for malware, as some phishing campaigns distribute additional payloads. Finally, remain vigilant for follow-up phishing attempts via email or other communication channels, as attackers may attempt to exploit compromised credentials further.