ABUSE NOTICE · 7D+ OPEN
Outgoing abuse reports are recorded; the latest stored availability evidence still shows the domain reachable.
Notification and current-status evidence
The sent-report ledger records the first outgoing report at .
The recorded recipient is complaint@gname.com.
The latest stored availability evidence still shows the domain reachable; 1 month has elapsed since the first outgoing report.
ICANN RAA §3.18 describes registrar abuse-contact and handling obligations.
This section records outgoing timestamps, listed recipients, case identifiers, and later availability. It does not by itself prove receipt, acknowledgement, investigation, remediation, or contractual non-compliance.
coinw.dog was a phishing site that posed as CoinW, a cryptocurrency exchange, and targeted CoinW customers. The page carried the plain title "CoinW" to pass as the real platform. PhishDestroy first flagged it on 2026-09-19. It has been offline since 2026-09-25, and the hosting provider was still blocking its content on 2026-10-19.
How the scam works
Exchange impersonation pages copy the look of the real login screen so a visitor arriving from an ad, a search result or a message believes they are on CoinW. Anything typed there, including email, password and one-time 2FA codes, goes straight to the operators. They can replay those details on the real exchange to empty the account. Some variants also show fake deposit addresses or ask for verification payments, so funds sent through the page go to the scammers.
Evidence
Six of 89 VirusTotal engines flagged the domain when it was checked on 2026-09-21: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Gridinsoft, SOCRadar and VIPRE. That is a modest count, but the detections come from unrelated vendors. The domain also appears on the MetaMask and SEAL blocklists alongside PhishDestroy. Wallet and security-community lists reached the same verdict independently.
Infrastructure
The domain was registered through GNAME.COM PTE. LTD. on 2025-09-21, almost a year before PhishDestroy detected it. That long gap suggests the name was registered early and held until the campaign went live. Traffic ran through Cloudflare, Inc. on an address located in Canada, so the origin server was hidden behind the proxy. Its Google Trust Services certificate shows only that the padlock appeared as it would on any site. The certificate is no evidence of legitimacy.
What to do
If you entered CoinW credentials on this page, sign in through the official CoinW app or a bookmarked address and change your password at once. Reset 2FA, and check login history, API keys and withdrawal whitelists for anything you did not add. If you sent a deposit or fee through the page, assume the funds went to the scammers and report the transaction to CoinW support. Change the password anywhere else you reused it. Defenders should block coinw.dog and watch for similar CoinW lookalike names, especially on novelty TLDs.
DOM Analysisanalyzed 2026年9月19日score 85/1006 brand signals
Submitted URLhttp://coinw.dog/
Favicon Hash
ケース ID
ICANN OVERSIGHT
認定と RAA の背景
Registrar accreditation and DNS abuse obligations
For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.
Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
