new-netcoinsllogin[.]webflow[.]io

Analysis of the domain new-netcoinsllogin.webflow.io indicates active credential phishing activity as of the report date, July 24, 2026. The domain is hosted on the IP address 104.18.36.248, a server commonly associated with Cloudflare's content delivery network, and it was registered through Webflow, Inc., a legitimate website‑building service. No explicit nameserver records are available, which suggests the domain may be using Webflow's default DNS configuration.

VirusTotal has recorded 13 detections out of 91 scanned security vendors, providing a modest but notable consensus that the domain exhibits malicious characteristics. The domain is listed on two public phishing blocklists and is actively blocked by PhishDestroy and OpenPhish, reinforcing its classification as a phishing vector. The current operational status remains active, meaning the domain continues to resolve and can be accessed by victims.

Concrete evidence beyond these infrastructure indicators—such as page title, SSL certificate details, or observed login forms—is not present in the available intelligence, leaving the exact content of the site unverified. Defenders should treat the domain as hostile: add it to network and endpoint block lists, enforce DNS filtering to prevent resolution, and monitor outbound connections toward the associated IP. Continuous re‑evaluation is advised in case the domain's hosting or detection profile changes, but the existing indicators are sufficient to justify immediate mitigation actions.