netcoinslogiii[.]webflow[.]io

PhishDestroy investigated netcoinslogiii.webflow.io, a domain impersonating the legitimate Netcoins cryptocurrency platform to steal user login credentials. This specific threat type is a crypto brand impersonation combined with credential harvesting, designed to trick users into entering their account details on a fraudulent login page. The site is currently offline, but its recent activity and registration details indicate it was actively used for phishing.

Technical analysis reveals that the domain was created on March 26, 2026, and registered through Webflow. It resolves to IP address 172.64.151.8, which is associated with Cloudflare's infrastructure, often abused by phishers for anonymity. The page title, "Netcoins Login – Crypto Investing Made Easy," closely mimics the legitimate site. Security vendors have flagged this domain: 19 out of 95 VirusTotal engines detected it as malicious, and it appears on one security blocklist. The SSL certificate was issued by Google Trust Services (WE1), providing a false sense of security to visitors.

Given the elevated risk level, users should avoid any interaction with this domain. Although currently offline, similar domains may appear. PhishDestroy recommends verifying URLs before entering credentials, enabling two-factor authentication on all crypto accounts, and reporting suspicious sites to authorities. Never click on links from unsolicited messages; always navigate directly to the official Netcoins website.