sso---en-ca--netcoins---com-cdn-auths[.]webflow[.]io

The domain sso---en-ca--netcoins---com-cdn-auths.webflow.io, now offline, was used for credential phishing, targeting Netcoins users. Despite being taken down, it was flagged by 9 out of 91 vendors on VirusTotal, indicating a significant threat level before its removal. The domain aimed to deceive users into providing sensitive login information under the guise of a legitimate Netcoins login page.

Registered through MarkMonitor, Inc., the domain was hosted on an IP address associated with Cloudflare, Inc. The SSL certificate was issued by Google Trust Services, adding a layer of perceived legitimacy to the site. The phishing page's title, "Netcoins | Login _ Sign In Your Account - "Official Site", was crafted to mimic the official Netcoins branding closely, increasing the likelihood of user deception.

PhishDestroy identified this domain on June 21, 2026, and it was subsequently included in one public blocklist. The platform risk score was assessed at 68 out of 100, reflecting a moderate to high threat potential. This case underscores the importance of early detection in combating phishing threats, as malicious domains often exploit the time gap between registration and widespread detection by antivirus vendors.