netcoinlogine-site[.]webflow[.]io

The domain netcoinlogine-site.webflow.io has been identified as a credential theft operation specifically targeting Netcoins, a cryptocurrency exchange platform. Analysis indicates this site impersonates the legitimate Netcoins login portal to harvest user credentials, enabling unauthorized access to digital asset accounts. The domain is currently offline, though prior activity suggests a focused campaign against cryptocurrency traders. Infrastructure analysis reveals the domain was registered through Webflow and resolves to the IP address 172.64.151.8. It is flagged by 18 of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0 out of 100. The domain appears on one security blocklist, specifically PhishDestroy. Detected technologies include Webflow hosting, Google Hosted Libraries, Google Font API, Cloudflare CDN, and HTTP/3 protocol. The SSL certificate is issued by Google Trust Services, a common feature in both legitimate and malicious sites to avoid immediate suspicion. Current evidence confirms the domain has been taken offline, though the threat actor may redeploy similar infrastructure under a different name. Users who accessed this domain should immediately reset Netcoins account credentials and enable multi-factor authentication. Organizations should monitor for repeated access attempts from the IP 172.64.151.8 or domains registered through Webflow exhibiting similar naming patterns. Security teams are advised to block the domain and associated IP at the network perimeter and conduct internal audits for any compromised credentials linked to this campaign.