netcoinlogine-net[.]webflow[.]io

Analysis of netcoinlogine-net.webflow.io shows a live web resource returning HTTP 200 and presenting the page title “Netcoins Login – Invest Your Crypto and Trade.” The domain resolves to 104.18.36.248, an address owned by Cloudflare (AS13335) and hosted in the United States. DNS is served by Cloudflare’s journey.ns.cloudflare.com and lamar.ns.cloudflare.com name servers. The site uses a Google Trust Services / WE1 SSL certificate, indicating a valid TLS chain despite the malicious intent. Registration data lists MarkMonitor, Inc. as the registrar, and the domain creation date is 08 May 2013, suggesting the name has been held for several years before being repurposed. Threat intelligence flags the domain as a credential‑phishing operation; 10 of 91 VirusTotal scanners have marked it malicious, and it appears on a single blocklist (PhishDestroy). Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious classification. While the page content has not been directly inspected, the combination of a credential‑phishing label, malicious scanner detections, and blocklist inclusion indicates a high‑risk profile. Defenders should block outbound traffic to the IP address 104.18.36.248, enforce DNS filtering for the domain, and monitor for credential submissions targeting the “Netcoins” brand. Continuous re‑evaluation is advised, as the site remains active and could be leveraged in broader credential‑harvesting campaigns.