sso-ca-netcoins-com-auth[.]webflow[.]io

The domain sso-ca-netcoins-com-auth.webflow.io is currently active and classified as a high‑risk generic phishing site targeting Netcoins credentials. The site presents a page titled "Netcoins | Login" and employs a Google Trust Services / WE1 SSL certificate, indicating the use of a legitimate certificate authority to increase credibility. Infrastructure analysis shows the domain resolves to IP 172.64.151.8, which belongs to AS13335 Cloudflare, Inc., and is geolocated in the United States. The domain was registered on May 28, 2026 through the Webflow platform; nameserver information is unavailable. Web reputation data indicates a Gridinsoft trust score of 0/100 and a HTTP 200 response, confirming that the page is reachable. The domain is listed on a single security blocklist and has been blocked by PhishDestroy. VirusTotal scans report that 17 of 91 security vendors flag the domain as malicious, reinforcing the phishing assessment. While the exact content of the login page has not been examined, the combination of a credential‑phishing scam type, active hosting, and multiple vendor detections suggests a functional credential‑harvesting operation. Defenders should block the domain at perimeter and DNS layers, monitor for related traffic to the associated IP address, and educate users about unsolicited Netcoins login prompts. Ongoing observation is recommended to detect any changes in hosting or additional malicious activity.