netcoinslogi-shop[.]webflow[.]io

This domain, netcoinslogi-shop.webflow.io, is flagged as a generic phishing site designed to impersonate the legitimate Netcoins cryptocurrency exchange platform. Analysis indicates the site presents a fraudulent login portal titled 'Netcoins Login - Secure Access to Crypto Portfolio,' targeting users with the intent to harvest account credentials. No specific drainer kit signatures have been identified, though the domain exhibits characteristics consistent with credential theft infrastructure commonly used in crypto-related phishing campaigns. Technical indicators confirm elevated risk: the domain is detected by 19 out of 95 security vendors on VirusTotal, appears on one security blocklist, and is currently blocked by PhishDestroy. Infrastructure analysis reveals the domain is hosted on Webflow, resolves to IP address 172.64.151.8, and is protected by a Google Trust Services SSL certificate (WE1). The IP geolocation points to Canada, though the hosting provider is Cloudflare, Inc., a common front for malicious domains seeking to obscure origin. No creation date is available, but the domain was operational long enough to be flagged by multiple detection engines. The domain has since been taken offline, reducing immediate risk of user compromise. However, residual threat remains as the infrastructure may be reactivated or repurposed under a different subdomain or top-level domain. Users who accessed the site prior to takedown should assume credential exposure and take immediate action: revoke active sessions, enable multi-factor authentication on legitimate platforms, and monitor accounts for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts.