coinw[.]capital

The domain www.coinw.capital has been identified as a brand impersonation threat, specifically targeting the Bitcoin brand. The domain is currently offline, but it poses an elevated risk due to its deceptive nature and potential for financial fraud.

Analysis indicates that www.coinw.capital was flagged by 10 out of 95 security vendors on VirusTotal, suggesting a significant level of suspicion. The domain appears on 1 security blocklist, further corroborating its malicious intent. Infrastructure analysis reveals that the domain resolves to the IP address 104.18.7.67, which is located in the United States and is associated with AS13335 Cloudflare, Inc. The domain was created on February 21, 2026, and is registered through GoDaddy.com, LLC. The SSL certificate for the domain is issued by DigiCert Inc / RapidSSL TLS RSA CA G1, which may lend false credibility to unsuspecting users. The page title found is 'Safe & Secure Crypto Exchange | Buy & Sell Bitcoin | CoinW', indicating a clear attempt to impersonate a legitimate crypto exchange.

Given the current status of the domain being taken offline, it is recommended that network administrators and security teams maintain vigilance and continue to monitor for any signs of reactivation. Users should be educated to recognize and avoid such deceptive domains, and any attempts to contact or transact with this domain should be strictly prohibited. Additionally, it is advised to implement DNS-based filtering and web content scanning to block access to this domain and similar threats.