net-coin[.]framer[.]wiki

Analysis of net-coin.framer.wiki reveals a credential-phishing domain impersonating NetCoins, a cryptocurrency platform. The domain was registered on February 21, 2026, through CSC Corporate Domains, Inc., and currently resolves to IP address 52.223.52.2, hosted on Amazon Web Services (AS16509) in the United States. The site is offline, returning an HTTP 404 status, but infrastructure evidence indicates prior malicious activity. The page title, 'Official site® – Login to NetCoins®- netcoins.com,' explicitly mimics NetCoins branding, aligning with the credential-phishing classification noted in threat intelligence. Security vendors have flagged the domain: 19 of 93 engines on VirusTotal detected it as malicious, and it appears on at least one security blocklist.

PhishDestroy has blocked the domain, further corroborating its fraudulent nature. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious sites, and does not mitigate the threat. Nameservers are hosted on AWS, a frequent infrastructure choice for phishing campaigns due to scalability and low cost. Technologies detected include Framer Sites, React, HSTS, and HTTP/3, which are not inherently malicious but are consistent with modern phishing kits designed to evade detection.

The domain’s registration details and hosting provider do not provide additional red flags beyond the established threat indicators. Defenders should treat this domain as compromised and maintain its blocklist status. While the site is currently offline, historical evidence and detection data justify elevated risk classification. No evidence suggests this domain is safe for user interaction.