netcoinslogin-setup[.]webflow[.]io

Analysis of netcoinslogin-setup.webflow.io as of July 25, 2026 indicates the domain was used to impersonate Netcoins in a crypto‑related scam. The site returned HTTP 404, suggesting the malicious page was removed or taken offline. The TLS certificate presented by the host was issued by Google Trust Services under the WE1 root, a legitimate certificate authority, which does not mitigate the fraudulent intent. DNS resolution points to 104.18.36.248, an address owned by AS13335 Cloudflare, Inc., located in the United States. The domain is served behind Cloudflare and supports HTTP/3, confirming the use of a common content‑delivery network for concealment and performance.

Registration data shows the domain was created on 08 May 2013 and is registered through MarkMonitor, Inc., a registrar often used for legitimate brand protection, indicating possible abuse of a legitimate registration channel. The nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com belong to Cloudflare’s default infrastructure. VirusTotal scans reported 17 detections out of 95 vendors, and the domain appears on a single external blocklist, PhishDestroy, confirming that independent security feeds have identified it as malicious. The page title captured during the brief observation, “Netcoins Login – Buy, Sell, Trade and Stake Crypto,” directly references the targeted brand and aligns with the declared scam type of a crypto scam.

No additional evidence such as malware payloads, redirect chains, or credential harvesting forms was captured. Consequently, the primary indicators of compromise are the brand‑targeted title, the malicious classification by multiple vendors, and the hosting infrastructure.