sso---ca-netcoins-com-auth[.]webflow[.]io

Analysis of the domain sso---ca-netcoins-com-auth.webflow.io indicates active credential phishing infrastructure targeting Netcoins users. The domain, registered on April 28, 2026, through Webflow, resolves to IP address 172.64.151.8, associated with Cloudflare, Inc. in Canada. The page title, 'Login | Netcoins,' explicitly suggests an attempt to mimic the legitimate Netcoins authentication portal, aligning with the credential phishing classification provided in available intelligence. The domain is currently active, returning an HTTP 200 status, and is hosted on Webflow with Cloudflare protection, utilizing HTTP/3 technology. Infrastructure review reveals the domain lacks identifiable nameservers and holds a trust score of 0/100 from Gridinsoft and 1/100 from Scamadviser, reinforcing its high-risk classification. It appears on one security blocklist and is flagged by 19 of 91 vendors in VirusTotal scans, though the absence of additional context limits attribution to a specific phishing kit or campaign. The SSL certificate, issued by Google Trust Services (WE1), does not provide further indicators of compromise beyond standard encryption practices. Defenders should prioritize blocking or monitoring traffic to this domain, particularly in environments where Netcoins credentials are used. The use of Webflow and Cloudflare infrastructure may complicate takedown efforts, necessitating coordination with both hosting and CDN providers. Given the domain's active status and clear targeting of a cryptocurrency platform, organizations should treat this as a high-risk threat and investigate potential credential exposure or lateral movement risks associated with compromised accounts.