en--netcoins-com---auth[.]webflow[.]io

PhishDestroy analysts have identified en--netcoins-com---auth.webflow.io as a generic phishing domain that impersonates the NetCoin.com authentication portal. The site was designed to harvest login credentials from unsuspecting users, posing as the legitimate NetCoin Sign-In page with the title "NetCoin.com Sign-In | Access Your Account Securely." No branded drainer kit was detected, but the domain clearly targeted NetCoin brand identity to appear trustworthy. This threat has been assessed at an elevated risk level due to its convincing appearance and active hosting infrastructure.

Technical indicators from the investigation show a VirusTotal detection rate of 19/95 security vendors flagging the domain, indicating significant malicious consensus. The domain was registered through NameCheap, Inc. and resolves to IP address 104.18.36.248, which is associated with Cloudflare infrastructure. It was created on February 21, 2026, and is currently not listed on Google Safe Browsing, though it appears on one security blocklist. An SSL certificate from Google Trust Services (WE1) was issued, adding to the deceptive legitimacy of the site.

As of the time of analysis, the domain is offline, suggesting that hosting providers or registrars have taken action to mitigate the threat. Users who may have encountered this phishing page should immediately change their NetCoin credentials and enable two-factor authentication. Remaining risk is low while the site remains offline, but similar domains may appear; monitoring for variations is recommended. PhishDestroy continues to track this threat and advises vigilance against credential harvesting attempts. Users should always verify URLs directly and avoid clicking links in unsolicited messages.