sso-ca-netcoins-com-aeuth[.]webflow[.]io

This domain hosts a credential theft infrastructure impersonating a legitimate login portal. The page is designed to collect user authentication details by presenting a fake Netcoins login interface. Such setups typically target account credentials and potentially enable unauthorized access to financial assets.

Technical analysis shows the domain sso-ca-netcoins-com-aeuth.webflow.io is flagged by 19/95 security vendors on VirusTotal, indicating broad detection coverage across multiple engines. The infrastructure resolves to IP 172.64.151.8 and is hosted within AS13335 (Cloudflare, Inc.), located in the US. The domain is registered through Webflow, and the page has been taken offline. It also appears on at least one security blocklist (PhishDestroy). The observed page title is "Netcoins | Login", indicating brand impersonation behavior aligned with credential harvesting operations.

If a user interacted with this page, it is recommended to treat all entered credentials as compromised. Immediate actions should include changing passwords for affected accounts, enabling multi-factor authentication, and reviewing account access logs for suspicious activity. Session tokens should be revoked where possible, and any linked financial accounts should be monitored for unauthorized transactions. Additional scanning of the device for malware or browser credential theft is also advised.