sso-ca--netcoins-com-auth[.]webflow[.]io

This domain, sso-ca--netcoins-com-auth.webflow.io, is actively engaged in credential harvesting targeting cryptocurrency users. The site impersonates the Netcoins single sign-on (SSO) portal, presenting a fraudulent login interface designed to capture usernames, passwords, and potentially two-factor authentication codes. Victims who enter credentials risk immediate account compromise, unauthorized fund transfers, or installation of wallet-draining malware. The threat primarily affects users attempting to access Netcoins services, as the domain name and page layout closely mimic legitimate authentication flows. Analysis indicates the domain was registered through Webflow, a platform commonly abused for rapid deployment of phishing pages due to its ease of use and free hosting tiers. The domain resolves to the IP address 104.18.36.248, associated with Cloudflare’s AS13335, a network frequently utilized to conceal malicious infrastructure. VirusTotal detections confirm the elevated risk, with 17 out of 95 security vendors flagging the domain as malicious. Additionally, the domain appears on at least one security blocklist, further validating its classification as an active phishing threat. The page title, sso-ca--netcoins-com-auth.webflow.io, directly references the impersonated brand, reinforcing the targeted nature of this campaign. Users who have visited this domain or entered credentials should take immediate action to mitigate potential damage. First, revoke access to any active sessions on the legitimate Netcoins platform and change passwords for all associated accounts, prioritizing those with financial or cryptocurrency access. Enable multi-factor authentication (MFA) if not already active, using app-based or hardware tokens rather than SMS-based methods. Monitor account activity for unauthorized transactions and report suspicious behavior to Netcoins support. If wallet credentials were exposed, transfer funds to a new, secure wallet address and consider revoking any linked API keys or third-party app permissions. Finally, scan local devices for malware using updated security tools to detect any secondary payloads deployed during the phishing attempt.