coinw-cn[.]at
“CoinW 登入 | 專業加密貨幣交易所 | CoinW 入口”
coinw-cn.at — Contenuto non disponibile. Simulazione del marchio: Apple. Riepilogo delle prove: VirusTotal 1/93 (SOCRadar); Spamhaus DBL_PHISH; PhishDestroy score 56/100. Registrar: Iqweb.
L’analisi dettagliata di PhishDestroy AI resta in inglese per preservare il rapporto forense originale.
This domain, coinw-cn.at, is assessed as an elevated-risk phishing site targeting users of the CoinW cryptocurrency exchange, as indicated by its page title: 'CoinW 登入 | 專業加密貨幣交易所 | CoinW 入口'. The domain was registered on February 27, 2026, through registrar Iqweb, and is currently offline. Infrastructure analysis reveals hosting on IP 186.2.175.29, located in Belize under AS59692 (IQWeb FZ-LLC), a network previously associated with fraudulent activity. The site employed technologies including Node.js, Vue.js, Nuxt.js, jQuery, Hammer.js, and DDoS-Guard, suggesting a moderately sophisticated frontend likely designed to mimic legitimate exchange platforms. Nameservers are hosted under CloudNS (pns71.cloudns.net, pns72.cloudns.com, pns73.cloudns.net, pns74.cloudns.uk), a provider occasionally used in phishing campaigns for its resilience and low-cost DNS services.
The SSL certificate is issued by Let's Encrypt (R13), a common choice for both legitimate and malicious sites due to its free, automated issuance. The domain appears on one security blocklist and has a Gridinsoft trust score of 0/100, indicating high suspicion. VirusTotal analysis shows one security vendor flagging the domain, though this limited detection does not rule out malicious intent, particularly given the domain's offline status at the time of assessment. No evidence of Safe Browsing or OTX listings is present in the available data.
Defenders should treat this domain as confirmed malicious infrastructure targeting CoinW users. Recommended actions include blocking the domain and IP at perimeter security controls, monitoring for related domains using the same registrar (Iqweb) or hosting provider (IQWeb FZ-LLC), and alerting users to potential credential harvesting attempts. The use of DDoS-Guard may indicate an attempt to protect the site from takedowns or analysis, further supporting its classification as intentionally deceptive.
Pipeline di risposta alle minacce
Stato della lista di blocco pubblica
Tecnologie · 6 identified
JavaScript runtime built on Chrome V8 engine for server-side development.
Progressive JavaScript framework for building user interfaces.
Hybrid Vue framework for server-side rendering and static sites.
Fast, small JavaScript library simplifying HTML manipulation, event handling, and Ajax.
Analisi di VirusTotal
Prove archiviate
Analisi delle prestazioni del sito
Google PageSpeed Insights — mobile performance audit of coinw-cn.at · checked Mar 2, 2026
Dati e relazioni esterne
PD-20260227-0B86C1 Recipient: abuse@iqweb.io Questo sito ti ha influenzato in qualche modo?
Se hai inserito credenziali dell'account, informazioni personali o di pagamento oppure hai scaricato un file da questo dominio, agisci immediatamente. Di seguito sono riportate le risorse per aiutarti a segnalare l'incidente e proteggerti.
Segnalalo alle autorità locali
Seleziona il tuo Paese per ottenere contatti ufficiali del crimine informatico o creare una bozza di reclamo →.
Verifica qualsiasi dominio
Analisi delle minacce utilizzando blocklist archiviate, WHOIS, DNS e prove di scansione pubblica
Scansiona oraSegnala un tentativo di phishing
Segnala i domini sospetti al nostro database delle minacce — proteggi la comunità
SegnalaFeed in tempo reale sulle minacce
Segnalazioni recenti di phishing e modifiche osservate della disponibilità
MonitoraRimani informato, rimani al sicuro
Controlla le minacce in tempo reale oppure contesta questa segnalazione se ritieni che si tratti di un falso positivo