sso-azure-ca-netcoins-com-cdn-auth[.]webflow[.]io

This domain, sso-azure-ca-netcoins-com-cdn-auth.webflow.io, is flagged as a credential theft operation targeting Netcoins, a cryptocurrency exchange platform. Analysis indicates the site mimics the legitimate Netcoins login interface, as evidenced by the page title 'Netcoins | Login,' to harvest user credentials. No direct evidence of a crypto drainer kit was observed, but the infrastructure aligns with credential harvesting tactics commonly used to facilitate subsequent unauthorized transactions or account takeovers. Infrastructure analysis reveals the domain was registered through Webflow on March 27, 2026, and resolves to the IP address 172.64.151.8. The SSL certificate is issued by Google Trust Services (WE1), a common feature in both legitimate and malicious sites to avoid immediate browser warnings. VirusTotal detection shows 19 out of 95 security vendors flag the domain as malicious, and it appears on one security blocklist. Google Safe Browsing status was not explicitly provided, but the domain's offline status suggests mitigation efforts may have been initiated. As of the latest assessment, sso-azure-ca-netcoins-com-cdn-auth.webflow.io is offline, reducing immediate risk to end users. However, the infrastructure remains a potential threat if reactivated or repurposed. Users who may have interacted with this domain are advised to reset credentials for any associated accounts, enable multi-factor authentication, and monitor for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts. The elevated risk level is retained due to the domain's recent activity and the targeted nature of the credential theft campaign.