page--en-netcoins---com-cdn---autth[.]webflow[.]io

This domain, page--en-netcoins---com-cdn---autth.webflow.io, is identified as a credential phishing site targeting users of the Netcoins cryptocurrency platform. The domain is currently offline but was previously active, presenting a login interface mimicking the legitimate Netcoins service to harvest user credentials. Analysis indicates the page title displayed was 'Netcoins | Login,' reinforcing the impersonation of the legitimate platform. Infrastructure analysis reveals the domain was registered through Webflow on March 07, 2026, and resolves to the IP address 104.18.36.248, hosted on AS13335 (Cloudflare, Inc.) in the United States. The SSL certificate is issued by Google Trust Services (WE1). The domain appears on one security blocklist and is flagged by 19 of 95 security vendors on VirusTotal, confirming its malicious classification. The creation date and hosting provider suggest an attempt to leverage cloud-based infrastructure for rapid deployment and evasion. The domain has been taken offline, reducing immediate risk to users. However, organizations and individuals are advised to block the domain and associated IP address (104.18.36.248) at the network level. Security teams should monitor for similar phishing domains registered through Webflow or hosted on Cloudflare infrastructure, particularly those impersonating financial or cryptocurrency services. End-users should verify domain authenticity before entering credentials and report suspicious activity to their security providers.