Analysing again…leaving that link out and working out which sites are still connected
ALL CONFIRMED SITES · one map: are they connected, and by what?
✓
Analysis complete
· 7 sites · 1 operation · 0 unattributed
Every site was mapped and investigated. The ties below use all of it.
7 sites end on the brand's own site. They are not phishing pages: the visitor lands on the real site, so nothing is stolen. They still are abuse when the link carries an affiliate id (the commission goes to a stranger) or goes through a redirect host that can send visitors elsewhere tomorrow.
They are rated for that already.
7 of 7 confirmed sites are tied together in 1 group. The largest has 7 sites that share the same TLS certificate, the same affiliate id on the brand's own site, the same registrant, the same server: coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io ….
0
confirmed sites
0
connected groups
0
sites in a group
0
no strong link
0
strong links
0
hints & common
The map
Show:
Big dot with a name = a site you confirmed (colour = severity) · small dot with a letter = something several sites have in common · line = “has that”, thicker = a stronger tie. Each operation sits in its own coloured area. Point at a dot to light up what it touches, click it for details. Scroll to zoom, drag the background to move the map, drag a dot to move it (double-click it to let go).
affiliate id · registrant · DNS token
server
TLS certificate · page code
analytics ID · where the data goes
redirect host
traffic campaign
dashed = a hint, not proof on its own
Which sites are connected · one card per operation (a group of sites that belong to one attacker)
$
Affiliate atid=51803 · via go-linkz.click
Operation 1 · Affiliate fraud — sends visitors to the real site with an affiliate id, to collect the commission
100
7sites
1brand
2026-02-25
→ 2026-09-03bought · in waves
→ 2026-09-03bought · in waves
7/7forward to the brand's own site with ?atid=51803
Because they share
affiliateatid=51803
95%
registrantops@affnet-mail.example
90%
certificatebbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb...
80%
server198.51.100.77
80%
Each of the 7 domains sends visitors to the real site with an affiliate id, to collect the commission. 5 of 7 domains were registered within 3 day(s) (2026-09-01 → 2026-09-03): a batch, not a coincidence. 7/7 forward to the brand's own site with ?atid=51803.
| Registrar | Mock Registrar LLC ×7 |
|---|---|
| Hosting | Mock Hosting LLC (hoster) ×4Fast VPS LLC (hoster) ×3 |
| Redirects via | go-linkz.click ×7 |
First step: Ask CoinPilot's affiliate team to ban atid=51803
Details
How to stop it 5
1. Ask CoinPilot's affiliate team to ban atid=51803
7 domains send their visitors to the real site with atid=51803. Banning that id and withholding its commission ends the reward for all of them at once.
coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io
2. Report the redirect host go-linkz.click
7 sites forward visitors through go-linkz.click. Its abuse contact can close every short link.
coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io
3. One bulk abuse report to Mock Registrar LLC
7 domains are registered there. List them all in one report, with the screenshots from the evidence packages.
coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io
4. Report the hosting provider Mock Hosting LLC
The provider can disable the servers that host these pages.
coinpilot-bot.io, coinplot.io, cooinpilot.io, koinpilot.io
5. Report the hosting provider Fast VPS LLC
The provider can disable the servers that host these pages.
coin-pilot.io, coinpilott.io, coinpllot.io
Who is with whom 3 clusters
Sites that share exactly the same things are shown together, so many links with the same sites read as one line.
coin-pilot.iocoinpilot-bot.iocoinpilott.iocoinpllot.iocoinplot.iocooinpilot.iokoinpilot.io
7 sites share:
affiliate atid=51803 95%registrant ops@affnet-mail.example 90%certificate bbbbbbbbbbbbbbbbbbb... 80%server ×3 198.51.100.77, 198.51.100.78, 198.51.100.79 80%redirects via go-linkz.click 60%page code page 2cefb68bc4 60%page look screenshot a8696e721b 30%
coinpilott.iocoinpllot.iocoinplot.iocooinpilot.iokoinpilot.io
5 sites share:
registered together Mock Registrar LLC... 30%
coin-pilot.iocoinpilot-bot.io
2 sites share:
registered together Mock Registrar LLC... 30%
Who against whom · how sure we are that two sites are one operation (hover a cell for what ties them)
coin-pilot.io | coinpilot-bot.io | coinpilott.io | coinpllot.io | coinplot.io | cooinpilot.io | koinpilot.io | |
|---|---|---|---|---|---|---|---|
| coin-pilot.io | 100 | 100 | 100 | 100 | 100 | 100 | |
| coinpilot-bot.io | 100 | 100 | 100 | 100 | 100 | 100 | |
| coinpilott.io | 100 | 100 | 100 | 100 | 100 | 100 | |
| coinpllot.io | 100 | 100 | 100 | 100 | 100 | 100 | |
| coinplot.io | 100 | 100 | 100 | 100 | 100 | 100 | |
| cooinpilot.io | 100 | 100 | 100 | 100 | 100 | 100 | |
| koinpilot.io | 100 | 100 | 100 | 100 | 100 | 100 |
Who shares what 7 of the 7 sites are on one server
Same server (address) 3
| 198.51.100.77 Fast VPS LLC · hoster |
7 sites coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io |
| 198.51.100.78 Mock Hosting LLC · hoster |
7 sites coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io |
| 198.51.100.79 Mock Hosting LLC · hoster |
7 sites coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io |
TLS certificates 1
| bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb... | 7 sites coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io |
Registrants 1
| ops@affnet-mail.example | 7 sites coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io |
Affiliate ids 1
| atid=51803 | 7 sites coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io |
Redirect hosts 1
| go-linkz.click | 7 sites coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io |
Name servers 2
| ns1.mock-dns.example | 7 sites coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io |
| ns2.mock-dns.example | 7 sites coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io |
Registrars 1
| Mock Registrar LLC | 7 sites coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io |
Bought together 2
| Mock Registrar LLC · 2026-09-01 → 2026-09-03 | 5 sites coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io |
| Mock Registrar LLC · 2026-02-25 → 2026-02-26 | 2 sites coin-pilot.io, coinpilot-bot.io |
Same page code 1
| page 2cefb68bc4 | 7 sites coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io |
Pages that look the same 1
| screenshot a8696e721b | 7 sites coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io |
Favicons 1
| 1130316202 | 7 sites coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io |
Site by site 7
| site | registered | registrar | server(s) | hosting | name servers | ends on |
|---|---|---|---|---|---|---|
| coin-pilot.io | 2026-02-26 | Mock Registrar LLC | 198.51.100.77 | Fast VPS LLC (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | www.coinpilot.io |
| coinpilot-bot.io | 2026-02-25 | Mock Registrar LLC | 198.51.100.79 | Mock Hosting LLC (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | www.coinpilot.io |
| coinpilott.io | 2026-09-03 | Mock Registrar LLC | 198.51.100.77 | Fast VPS LLC (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | www.coinpilot.io |
| coinpllot.io | 2026-09-03 | Mock Registrar LLC | 198.51.100.77 | Fast VPS LLC (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | www.coinpilot.io |
| coinplot.io | 2026-09-02 | Mock Registrar LLC | 198.51.100.78 | Mock Hosting LLC (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | www.coinpilot.io |
| cooinpilot.io | 2026-09-01 | Mock Registrar LLC | 198.51.100.79 | Mock Hosting LLC (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | www.coinpilot.io |
| koinpilot.io | 2026-09-02 | Mock Registrar LLC | 198.51.100.78 | Mock Hosting LLC (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | www.coinpilot.io |
What ties them together 11
the same affiliate id on the brand's own site95%
atid=51803 · 7 sites
atid=51803 · 7 sites
the same registrant90%
ops@affnet-mail.example · 7 sites
ops@affnet-mail.example · 7 sites
the same TLS certificate80%
bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb · 7 sites
bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb · 7 sites
the same server80%
198.51.100.77 · 7 sites · Fast VPS LLC
198.51.100.77 · 7 sites · Fast VPS LLC
the same server80%
198.51.100.78 · 7 sites · Mock Hosting LLC
198.51.100.78 · 7 sites · Mock Hosting LLC
the same server80%
198.51.100.79 · 7 sites · Mock Hosting LLC
198.51.100.79 · 7 sites · Mock Hosting LLC
the same redirect host60% · hint
go-linkz.click · 7 sites
go-linkz.click · 7 sites
the same page code60% · hint
page 2cefb68bc4 · 7 sites
page 2cefb68bc4 · 7 sites
registered together at one registrar30% · hint
Mock Registrar LLC · 2026-02-25 → 2026-02-26 · 2 sites
Mock Registrar LLC · 2026-02-25 → 2026-02-26 · 2 sites
registered together at one registrar30% · hint
Mock Registrar LLC · 2026-09-01 → 2026-09-03 · 5 sites
Mock Registrar LLC · 2026-09-01 → 2026-09-03 · 5 sites
a page that looks the same30% · hint
screenshot a8696e721b · 7 sites
screenshot a8696e721b · 7 sites
Also in common, but weak (they never group sites):
the same favicon
1130316202
1130316202
the same registrar
Mock Registrar LLC
Mock Registrar LLC
the same name server
ns1.mock-dns.example
ns1.mock-dns.example
the same name server
ns2.mock-dns.example
ns2.mock-dns.example
Evidence per site 7
| site | affiliate id | registrant | certificate | ip | redirector | kit | batch | kit look |
|---|---|---|---|---|---|---|---|---|
| coin-pilot.io | ● | ● | ● | ●3 | ● | ● | ● | ● |
| coinpilot-bot.io | ● | ● | ● | ●3 | ● | ● | ● | ● |
| coinpilott.io | ● | ● | ● | ●3 | ● | ● | ● | ● |
| coinpllot.io | ● | ● | ● | ●3 | ● | ● | ● | ● |
| coinplot.io | ● | ● | ● | ●3 | ● | ● | ● | ● |
| cooinpilot.io | ● | ● | ● | ●3 | ● | ● | ● | ● |
| koinpilot.io | ● | ● | ● | ●3 | ● | ● | ● | ● |
The pattern · what these attacks have in common
7 sites (7 critical). 5 of 7 domains were registered within 3 day(s) (2026-09-01 → 2026-09-03): a batch, not a coincidence; names: 5 × a typo of the brand, 2 × the brand plus extra words; endings: .io (7); hosted in Russia (3), Türkiye (2), United States (2).
- 5 of 7 domains were registered within 3 day(s) (2026-09-01 → 2026-09-03): a batch, not a coincidence
- names: 5 × a typo of the brand, 2 × the brand plus extra words
- endings: .io (7)
- hosted in Russia (3), Türkiye (2), United States (2)
- the kit copies the brand's favicon (7/7); copies the brand's homepage (7/7); asks for a password (7/7)
Registered, oldest first:
2026-02-25 coinpilot-bot.io2026-02-26 coin-pilot.io2026-09-01 cooinpilot.io2026-09-02 coinplot.io2026-09-02 koinpilot.io2026-09-03 coinpilott.io2026-09-03 coinpllot.io
What counts as a connection · switch a whole kind off if it proves nothing to you
For example the Cloudflare account or the registrar: many unrelated sites share them. Switching a kind off takes it out of the analysis and the map is analysed again. To leave out only one thing, use the red “not evidence” button next to it in the cards above.