ca--netcoins-logi--cnd[.]webflow[.]io

This domain, ca--netcoins-logi--cnd.webflow.io, is identified as a credential harvesting phishing site targeting users of the Netcoins cryptocurrency platform. The site presents a fraudulent login interface, titled 'Netcoins | Sign In | Log In,' designed to deceive victims into submitting their authentication credentials. Analysis indicates the domain is engineered to exfiltrate sensitive information, including usernames, passwords, and potentially multi-factor authentication codes, which could lead to unauthorized account access and financial theft. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NameCheap, Inc., and resolves to the IP address 104.18.36.248, hosted on Cloudflare's network (AS13335). Detection metrics show 20 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on one additional security blocklist. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as phishing sites frequently leverage valid certificates to appear legitimate. The domain's current status is offline, but its prior activity and infrastructure remain a concern. Users who visited ca--netcoins-logi--cnd.webflow.io should immediately revoke any entered credentials and enable multi-factor authentication on their legitimate Netcoins account. Monitor associated accounts for unauthorized transactions or access attempts. If financial data was submitted, contact the platform's support team to report the incident and request account freezing. Security teams should update blocklists to include this domain and its resolving IP address, 104.18.36.248, to prevent future access. Review logs for connections to the domain or IP to identify potential compromise within networks.