sso-en-ca-netcoins-com-cdn-autuh[.]webflow[.]io

This domain, sso-en-ca-netcoins-com-cdn-autuh.webflow.io, is identified as a fake login portal specifically targeting users of the Netcoins cryptocurrency exchange platform. The page impersonates the legitimate Netcoins authentication interface, presenting a high-fidelity replica of the official login page under the title 'Netcoins | Login.' As of the latest assessment, the domain has been taken offline, though prior activity suggests it was actively harvesting credentials for unauthorized account access and potential financial theft. Analysis indicates the domain was flagged by 20 of 95 security vendors on VirusTotal, reflecting a moderate-to-high confidence in its malicious classification. It was registered through Webflow, a platform commonly used for rapid deployment of web pages, which may have facilitated its quick setup and evasion of initial scrutiny. The domain resolved to the IP address 172.64.151.8, geolocated in the United States under AS13335 (Cloudflare, Inc.), a network frequently leveraged to obscure hosting origins. The domain appears on one security blocklist, and no additional historical data or creation date is available for further temporal analysis. Current status confirms the domain is offline, reducing immediate risk of user exposure. However, the infrastructure and tactics observed—such as the use of Cloudflare and Webflow—are consistent with phishing campaigns that may re-emerge under similar domains. Organizations and users are advised to monitor for domains mimicking Netcoins or other crypto exchanges, particularly those using subdomain patterns like 'sso-en-ca' or 'cdn-autuh.' Network-level blocking of the IP 172.64.151.8 and its associated CIDR range is recommended as a precautionary measure. Users should verify the authenticity of login portals via official exchange URLs and enable multi-factor authentication to mitigate credential theft risks.