sso-en-nnetcoins-com-ccdn-auth[.]webflow[.]io

This domain, sso-en-nnetcoins-com-ccdn-auth.webflow.io, is identified as a credential theft operation targeting users of the cryptocurrency platform Netcoins. Analysis of the page title, "Netcoins | Login," confirms brand impersonation designed to harvest login credentials through a fraudulent authentication portal. No direct evidence of a crypto drainer kit was observed, though the domain structure and hosting pattern align with known credential harvesting campaigns targeting financial services. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NameCheap, Inc., and resolves to the IP address 172.64.151.8, hosted on Cloudflare’s AS13335. VirusTotal detection metrics indicate 18 out of 95 security vendors flagged the domain as malicious. The domain appears on one security blocklist, and its SSL certificate is issued by Google Trust Services (WE1). Google Safe Browsing status was not explicitly provided, but the domain’s offline status suggests prior enforcement action. The domain is currently offline, likely due to takedown or suspension measures. Despite its inactive status, residual risk remains for users who may have interacted with the site prior to deactivation. Organizations are advised to monitor for credential reuse attempts and implement multi-factor authentication (MFA) for all financial and cryptocurrency-related accounts. Network-level blocking of the domain and associated IP (172.64.151.8) is recommended as a preventive measure.