netcoinlogi-account[.]webflow[.]io

The domain netcoinlogi-account.webflow.io is suspected to be involved in credential phishing activities, targeting users of the cryptocurrency platform Netcoins. This domain mimics the login page of Netcoins, aiming to deceive users into providing their credentials. No specific drainer kit has been identified, but the threat is significant given the domain's current status and the technical indicators.

Infrastructure analysis reveals that netcoinlogi-account.webflow.io has a VirusTotal detection score of 22/95, indicating that a substantial number of security vendors have flagged it as malicious. The domain is registered through Webflow and resolves to the IP address 104.18.36.248. It also appears on one security blocklist, further corroborating its malicious intent. The SSL certificate is issued by Google Trust Services / WE1, which may have been used to increase user trust in the fake login page. However, the domain is currently marked as taken offline, suggesting that it has been disrupted or removed from active use.

Despite the domain being taken offline, the elevated risk level remains due to the potential for reactivation or similar attacks. It is advisable for Netcoins users to remain vigilant and verify the URLs of login pages before entering credentials. Security teams should monitor for any re-emergence of this domain or similar variants. The current offline status reduces the immediate threat, but proactive measures are still necessary to prevent future incidents.