secure--s-netcoins-com---auth[.]webflow[.]io

This domain, secure--s-netcoins-com---auth.webflow.io, is presently classified as a credential‑phishing site targeting users of the Netcoins service. The page title observed during retrieval is “Netcoins | Login”, indicating an attempt to masquerade as a legitimate authentication portal. The domain was created on 21 February 2026 and is hosted behind Cloudflare’s network (ASN 13335) with the IP address 172.64.151.8 located in the United States. The hosting infrastructure utilizes Cloudflare’s DNS service, as evidenced by the authoritative nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com, and the site serves content over HTTPS using a certificate issued by Google Trust Services (WE1). The web application is built on the Webflow platform and supports HTTP/3, which is consistent with the observed technology fingerprint.

Reputation checks show a Gridinsoft trust score of 0 out of 100, reflecting an extremely low confidence rating. The domain appears on a single security blocklist and is actively blocked by PhishDestroy, confirming that at least one external sinkhole has taken remediation action. VirusTotal analysis reports that 14 of 93 scanning engines flag the domain as malicious, reinforcing the phishing classification. The HTTP response code is 200, indicating that the page is reachable and delivering content without redirection. The registrar for the domain is NameCheap, Inc., a widely used registration service.

No additional intelligence such as Safe Browsing or Open Threat Exchange entries is provided, leaving those vectors unverified. Given the combination of a recently created domain, low trust score, presence on a blocklist, multiple vendor detections, and the use of a trusted SSL certificate to lend legitimacy, defenders should treat this host as hostile.