coinw-cn[.]at
“CoinW 登入 | 專業加密貨幣交易所 | CoinW 入口”
coinw-cn.at — Conteúdo indisponível. Representação da marca: Apple. Resumo das evidências: VirusTotal 1/93 (SOCRadar); Spamhaus DBL_PHISH; PhishDestroy score 56/100. Registrador: Iqweb.
A análise detalhada do PhishDestroy AI permanece em inglês para preservar o registro forense original.
This domain, coinw-cn.at, is assessed as an elevated-risk phishing site targeting users of the CoinW cryptocurrency exchange, as indicated by its page title: 'CoinW 登入 | 專業加密貨幣交易所 | CoinW 入口'. The domain was registered on February 27, 2026, through registrar Iqweb, and is currently offline. Infrastructure analysis reveals hosting on IP 186.2.175.29, located in Belize under AS59692 (IQWeb FZ-LLC), a network previously associated with fraudulent activity. The site employed technologies including Node.js, Vue.js, Nuxt.js, jQuery, Hammer.js, and DDoS-Guard, suggesting a moderately sophisticated frontend likely designed to mimic legitimate exchange platforms. Nameservers are hosted under CloudNS (pns71.cloudns.net, pns72.cloudns.com, pns73.cloudns.net, pns74.cloudns.uk), a provider occasionally used in phishing campaigns for its resilience and low-cost DNS services.
The SSL certificate is issued by Let's Encrypt (R13), a common choice for both legitimate and malicious sites due to its free, automated issuance. The domain appears on one security blocklist and has a Gridinsoft trust score of 0/100, indicating high suspicion. VirusTotal analysis shows one security vendor flagging the domain, though this limited detection does not rule out malicious intent, particularly given the domain's offline status at the time of assessment. No evidence of Safe Browsing or OTX listings is present in the available data.
Defenders should treat this domain as confirmed malicious infrastructure targeting CoinW users. Recommended actions include blocking the domain and IP at perimeter security controls, monitoring for related domains using the same registrar (Iqweb) or hosting provider (IQWeb FZ-LLC), and alerting users to potential credential harvesting attempts. The use of DDoS-Guard may indicate an attempt to protect the site from takedowns or analysis, further supporting its classification as intentionally deceptive.
Pipeline de resposta a ameaças
Status da lista de bloqueios pública
Tecnologias · 6 identified
JavaScript runtime built on Chrome V8 engine for server-side development.
Progressive JavaScript framework for building user interfaces.
Hybrid Vue framework for server-side rendering and static sites.
Fast, small JavaScript library simplifying HTML manipulation, event handling, and Ajax.
Análise do VirusTotal
Evidências arquivadas
Análise de desempenho do site
Google PageSpeed Insights — mobile performance audit of coinw-cn.at · checked Mar 2, 2026
Evidências e relatórios externos
PD-20260227-0B86C1 Recipient: abuse@iqweb.io Você foi afetado por este site?
Se você inseriu credenciais de conta, informações pessoais ou de pagamento, ou baixou um arquivo deste domínio, tome medidas imediatas. Abaixo estão os recursos para ajudá-lo a relatar o incidente e se proteger.
Notifique as autoridades locais
Selecione seu país para obter contactos oficiais do cibercrime ou crie um rascunho de reclamação →.
Verificar qualquer domínio
Análise de ameaças usando lista de bloqueio armazenada, WHOIS, DNS e evidências de verificação pública
Digitalize agoraDenunciar phishing
Envie domínios suspeitos para nosso banco de dados de ameaças — proteja a comunidade
DenunciarFeed de ameaças em tempo real
Relatórios recentes de phishing e alterações de disponibilidade observadas
MonitorarMantenha-se informado, mantenha-se seguro
Monitore ameaças em tempo real ou conteste esta listagem caso acredite que se trate de um falso positivo