ca-netcoins-app-com-auth[.]webflow[.]io

This domain, ca-netcoins-app-com-auth.webflow.io, poses a credential phishing threat targeting users of the Netcoins cryptocurrency platform. Analysis indicates the site mimics the legitimate Netcoins login portal, likely designed to harvest user credentials, including usernames, passwords, and potentially two-factor authentication codes. Given the domain's focus on cryptocurrency, compromised accounts could lead to unauthorized asset transfers, financial loss, or further exploitation through social engineering or malware distribution. Infrastructure analysis reveals the domain is registered through Webflow and currently resolves to the IP address 172.64.151.8, hosted on AS13335 Cloudflare, Inc. in the United States. The domain appears on one security blocklist and is flagged by 19 out of 95 security vendors on VirusTotal, indicating a consensus on its malicious nature. The page title, 'Netcoins | Login,' directly matches the legitimate service, increasing the likelihood of successful deception. No historical data suggests prolonged activity, but its recent takedown aligns with typical phishing campaign lifecycles. Users who visited this domain or entered credentials should immediately revoke access to any associated Netcoins accounts and enable multi-factor authentication if not already active. Monitor linked accounts for unauthorized transactions or login attempts, and consider resetting passwords for other platforms where identical credentials may have been reused. If financial activity is detected, report the incident to the relevant cryptocurrency platform and local cybersecurity authorities. Network administrators should block the domain and its resolving IP (172.64.151.8) to prevent further access attempts within their environments.