sso-ca-netcoins----cdn[.]webflow[.]io

PhishDestroy identifies the domain sso-ca-netcoins----cdn.webflow.io as an active phishing scam targeting cryptocurrency users by mimicking a Netcoins single sign-on portal. This domain poses an elevated risk due to its use of deceptive branding and a fraudulent login interface designed to harvest user credentials and session tokens. The threat actor leverages the trusted Webflow.io CDN subdomain and a Google Trust Services SSL certificate to lend superficial legitimacy to the phishing page, increasing the likelihood of successful deception.

This domain was flagged by 20 out of 95 VirusTotal security vendors, indicating widespread detection as malicious. It resolves to IP address 172.64.151.8, a Cloudflare infrastructure node commonly abused by threat actors for hosting phishing content. The SSL certificate issued to this domain is signed by Google Trust Services, which does not validate the legitimacy of the underlying service—only the cryptographic authenticity of the certificate itself. As a dynamically generated subdomain under webflow.io, it lacks a traditional creation date, but its current malicious status is confirmed through real-time detection feeds and active phishing reports.

Users should immediately block access to sso-ca-netcoins----cdn.webflow.io and avoid entering any login credentials or personal information. Organizations are advised to block the domain at DNS and firewall levels using threat intelligence feeds. Since this domain uses a Google-issued SSL certificate, traditional certificate pinning or SSL inspection may not detect the fraud; behavioral analysis and user awareness remain critical. Report any exposure or suspicious access to your security team or through official phishing reporting channels. The threat actor’s use of a trusted CDN and legitimate certificate underscores the need for multi-factor authentication and zero trust access policies to mitigate credential theft.