homepage-netcoiins-web[.]square[.]site

The domain homepage-netcoiins-web.square.site has been identified as part of a phishing campaign targeting users of the Netcoins platform. This domain was specifically created to impersonate the Netcoins login page, potentially to harvest user credentials for malicious purposes. The threat type is classified as generic phishing, and while no specific drainer kit has been documented, the nature of the impersonation suggests a credential harvesting attempt.

Technical analysis of the domain reveals several critical indicators. According to VirusTotal, the domain is flagged by 12 out of 95 security vendors, indicating a moderate level of detection across different security platforms. The domain is registered through MarkMonitor, Inc., a registrar known for managing high-profile domains. It resolves to the IP address 74.115.51.4, hosted in the United States under AS27647 by Weebly, Inc. The domain was initially created on February 05, 2019, and uses a Let's Encrypt SSL certificate with the identifier E7. It appears on two security blocklists, highlighting its recognition as a threat by at least some threat intelligence services.

As of the current status, the domain has been taken offline, reducing its immediate threat level. It has been blocked by PhishDestroy and PhishingDB, which indicates active measures taken to mitigate its impact. Despite these actions, users should remain vigilant, as such domains can be reactivated or cloned onto new infrastructures. Security teams should ensure that similar domain patterns are monitored, and end-users are advised to confirm URLs before entering sensitive information. The elevated risk level implies that organizations dependent on the impersonated brand should enhance their phishing detection and response capabilities to prevent potential future incidents.