sso-netcoins-ca-com-auth[.]webflow[.]io

This domain is flagged for elevated risk due to targeted credential theft impersonating Netcoins, a cryptocurrency exchange platform. The fraudulent site mimics legitimate login portals to harvest user credentials, potentially leading to unauthorized account access and financial loss. Analysis indicates this is not a generic phishing attempt but a focused attack on Netcoins customers, increasing the likelihood of successful compromise for users unaware of the deception. Infrastructure analysis reveals the domain sso-netcoins-ca-com-auth.webflow.io was registered on February 21, 2026, through NameCheap, Inc. It resolves to IP address 104.18.36.248, hosted on Cloudflare's network (AS13335). The SSL certificate is issued by Google Trust Services (WE1), a common obfuscation tactic to appear legitimate. Security vendors on VirusTotal flagged the domain at a rate of 13/95, and it appears on one security blocklist. The page title 'Netcoins | Login' confirms the impersonation of the legitimate Netcoins authentication portal. Mitigation requires immediate action from both users and administrators. Users who accessed the domain should reset Netcoins account credentials via the official platform and enable multi-factor authentication. Security teams should block the domain and IP 104.18.36.248 at perimeter defenses, and monitor for credential reuse across other services. Organizations should also review logs for connections to the domain or IP, particularly from endpoints handling cryptocurrency transactions. Given the domain's current offline status, proactive measures should focus on detecting similar impersonation attempts using the same infrastructure patterns.