sso-eng-netcoins-com-cdn---azure[.]webflow[.]io

The domain sso-eng-netcoins-com-cdn---azure.webflow.io was registered on February 21, 2026 through NameCheap, Inc. and is hosted on Cloudflare’s network (AS13335) with the IP address 172.64.151.8 located in the United States. Infrastructure analysis shows the site was built on Webflow and served over HTTP/3, using Cloudflare’s nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com. The TLS certificate is issued by Google Trust Services under the WE1 profile, indicating a valid HTTPS endpoint despite the site’s current offline state. An HTTP request to the root returned a 404 status, and Gridinsoft assigned a trust score of 0 out of 100, reflecting a high likelihood of malicious intent.

VirusTotal scans flagged the domain in 16 of 95 security engines, and the site is listed on at least one public blocklist, with PhishDestroy explicitly marking it as blocked. The page title retrieved during the brief crawl was "Netcoins | Login," matching the declared scam type of credential phishing. The risk rating is elevated, and the unique seed 225fde ties this observation to the broader intelligence set.

While the site is presently taken offline, the combination of a brand‑targeted login title, low trust score, multiple vendor detections, and active blocklist entries suggests an ongoing credential‑phishing campaign aimed at Netcoins users. Defenders should add the domain and its associated IP range to deny‑list rules, monitor DNS queries for similar sub‑domains, and enforce multi‑factor authentication for any Netcoins‑related services. Continuous re‑scanning is advised to capture any re‑hosting attempts, and security teams should treat any traffic to this host as malicious until further evidence indicates otherwise.