netcoinloginbutton[.]webflow[.]io

This domain, netcoinloginbutton.webflow.io, is specifically designed to pose as a legitimate cryptocurrency login page to steal user credentials. The threat actors behind this domain aim to deceive users into believing they are accessing a genuine Netcoins platform, thereby prompting them to enter their login details, which are then captured and used for unauthorized access to their accounts.

Analysis indicates that the domain was registered on February 21, 2026, through NameCheap, Inc. Infrastructure analysis reveals that it resolves to the IP address 104.18.36.248, located in the United States and managed by AS13335 Cloudflare, Inc. The SSL certificate is issued by Google Trust Services, which may lend a false sense of security to unsuspecting users. The domain has been flagged as malicious by 18 out of 95 security vendors on VirusTotal, and it appears on one security blocklist, specifically PhishDestroy. These indicators suggest an elevated risk level associated with the domain.

Users who have visited netcoinloginbutton.webflow.io are advised to immediately change their passwords for any cryptocurrency exchange accounts and enable two-factor authentication (2FA) if not already in place. Additionally, users should monitor their financial accounts for any unauthorized transactions and report any suspicious activity to their exchange's customer support. It is crucial to remain vigilant and avoid clicking on links from unknown sources, especially those purporting to be from cryptocurrency platforms.