sso--netcoins-io-com-cdn-en[.]webflow[.]io

The domain sso--netcoins-io-com-cdn-en.webflow.io is currently flagged as an active credential theft operation impersonating Netcoins, a cryptocurrency exchange platform. Analysis indicates the site is designed to harvest user login credentials, likely for unauthorized account access or subsequent financial theft. The domain remains operational as of this report, with no indication of takedown or remediation efforts by the hosting provider or registrar. Infrastructure analysis reveals the domain is hosted on Cloudflare infrastructure (AS13335) and resolves to the IP address 172.64.151.8, located in the United States. The domain is registered through Webflow, a platform commonly used for rapid website deployment, which may explain its recent appearance in threat intelligence feeds. Security vendors have detected malicious activity, with 16 of 95 VirusTotal engines flagging the domain as malicious. The site appears on at least one security blocklist, and its page title, "Login In My Account | Netcoins$ Login," explicitly mimics Netcoins' branding, including the use of the dollar sign to lend false legitimacy. No historical WHOIS data is available due to the domain's recent registration and privacy protections, but the lack of legitimate ties to Netcoins further supports its classification as fraudulent. The risk level for this domain is assessed as elevated due to its active status, direct targeting of financial services users, and the potential for significant harm if credentials are compromised. Users are advised to avoid interacting with the domain and to verify the authenticity of any login portal claiming to belong to Netcoins by cross-referencing official communications or visiting the platform's verified website directly. Organizations should update blocklists to include this domain and its associated IP address, while monitoring for related infrastructure that may emerge. If credentials have already been entered, immediate password resets and multi-factor authentication enablement are recommended for all associated accounts.