coinw-cn[.]at

This domain, coinw-cn.at, is assessed as an elevated-risk phishing site targeting users of the CoinW cryptocurrency exchange, as indicated by its page title: 'CoinW 登入 | 專業加密貨幣交易所 | CoinW 入口'. The domain was registered on February 27, 2026, through registrar Iqweb, and is currently offline. Infrastructure analysis reveals hosting on IP 186.2.175.29, located in Belize under AS59692 (IQWeb FZ-LLC), a network previously associated with fraudulent activity. The site employed technologies including Node.js, Vue.js, Nuxt.js, jQuery, Hammer.js, and DDoS-Guard, suggesting a moderately sophisticated frontend likely designed to mimic legitimate exchange platforms. Nameservers are hosted under CloudNS (pns71.cloudns.net, pns72.cloudns.com, pns73.cloudns.net, pns74.cloudns.uk), a provider occasionally used in phishing campaigns for its resilience and low-cost DNS services.

The SSL certificate is issued by Let's Encrypt (R13), a common choice for both legitimate and malicious sites due to its free, automated issuance. The domain appears on one security blocklist and has a Gridinsoft trust score of 0/100, indicating high suspicion. VirusTotal analysis shows one security vendor flagging the domain, though this limited detection does not rule out malicious intent, particularly given the domain's offline status at the time of assessment. No evidence of Safe Browsing or OTX listings is present in the available data.

Defenders should treat this domain as confirmed malicious infrastructure targeting CoinW users. Recommended actions include blocking the domain and IP at perimeter security controls, monitoring for related domains using the same registrar (Iqweb) or hosting provider (IQWeb FZ-LLC), and alerting users to potential credential harvesting attempts. The use of DDoS-Guard may indicate an attempt to protect the site from takedowns or analysis, further supporting its classification as intentionally deceptive.