7
confirmed sites
100%
confidence · certain
Affiliate fraud
what it does
2026-02-25 → 2026-09-03
domains registered · in waves
5
ways to stop it
Because the same affiliate id on the brand's own site atid=51803 95%the same registrant ops@affnet-mail.example 90%the same TLS certificate bbbbbbbbbbbbbbbbbbbbbbbbbbb... 80%the same server 198.51.100.77 80% · 3 of them
Each of the 7 domains sends visitors to the real site with an affiliate id, to collect the commission. 5 of 7 domains were registered within 3 day(s) (2026-09-01 → 2026-09-03): a batch, not a coincidence. 7/7 forward to the brand's own site with ?atid=51803.
- 7/7 forward to the brand's own site with ?atid=51803
- not phishing: nothing is stolen from the visitor, who ends on the real site; the abuse is the commission, and the redirect host that could send visitors elsewhere
How to stop it · the shortest way, first
1
Ask CoinPilot's affiliate team to ban atid=51803
7 domains send their visitors to the real site with atid=51803. Banning that id and withholding its commission ends the reward for all of them at once.
coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io
2
Report the redirect host go-linkz.click
7 sites forward visitors through go-linkz.click. Its abuse contact can close every short link.
coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io
3
One bulk abuse report to Mock Registrar LLC
7 domains are registered there. List them all in one report, with the screenshots from the evidence packages.
coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io
4
Report the hosting provider Mock Hosting LLC
The provider can disable the servers that host these pages.
coinpilot-bot.io, coinplot.io, cooinpilot.io, koinpilot.io
5
Report the hosting provider Fast VPS LLC
The provider can disable the servers that host these pages.
coin-pilot.io, coinpilott.io, coinpllot.io
The sites · 7
| Site | Severity | Registered | Registrar | Server(s) | Hosting | Name servers | Ends on |
|---|---|---|---|---|---|---|---|
| coin-pilot.io atid=51803 |
critical | 2026-02-26 | Mock Registrar LLC | 198.51.100.77 | Fast VPS LLC (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | www.coinpilot.io |
| coinpilot-bot.io atid=51803 |
critical | 2026-02-25 | Mock Registrar LLC | 198.51.100.79 | Mock Hosting LLC (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | www.coinpilot.io |
| coinpilott.io atid=51803 |
critical | 2026-09-03 | Mock Registrar LLC | 198.51.100.77 | Fast VPS LLC (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | www.coinpilot.io |
| coinpllot.io atid=51803 |
critical | 2026-09-03 | Mock Registrar LLC | 198.51.100.77 | Fast VPS LLC (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | www.coinpilot.io |
| coinplot.io atid=51803 |
critical | 2026-09-02 | Mock Registrar LLC | 198.51.100.78 | Mock Hosting LLC (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | www.coinpilot.io |
| cooinpilot.io atid=51803 |
critical | 2026-09-01 | Mock Registrar LLC | 198.51.100.79 | Mock Hosting LLC (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | www.coinpilot.io |
| koinpilot.io atid=51803 |
critical | 2026-09-02 | Mock Registrar LLC | 198.51.100.78 | Mock Hosting LLC (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | www.coinpilot.io |
Who is with whom · 3 clusters
7 of the 7 sites are on one server. Sites that share exactly the same things are shown together, so a long list of links reads as one line.
coin-pilot.iocoinpilot-bot.iocoinpilott.iocoinpllot.iocoinplot.iocooinpilot.iokoinpilot.io
7 sites share
affiliate atid=51803 95%registrant ops@affnet-mail.example 90%certificate bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb 80%server ×3 198.51.100.77, 198.51.100.78, 198.51.100.79 80%redirects via go-linkz.click 60%page code page 2cefb68bc4 60%page look screenshot a8696e721b 30%
coinpilott.iocoinpllot.iocoinplot.iocooinpilot.iokoinpilot.io
5 sites share
registered together Mock Registrar LLC · 2026-09-01 → 2026-09-03 30%
coin-pilot.iocoinpilot-bot.io
2 sites share
registered together Mock Registrar LLC · 2026-02-25 → 2026-02-26 30%
Who against whom
How sure we are that two sites are one operation (the darker the cell, the surer). The number is shown from 75%, where two sites count as one operation.
coin-pilot.io | coinpilot-bot.io | coinpilott.io | coinpllot.io | coinplot.io | cooinpilot.io | koinpilot.io | |
|---|---|---|---|---|---|---|---|
| coin-pilot.io | 100 | 100 | 100 | 100 | 100 | 100 | |
| coinpilot-bot.io | 100 | 100 | 100 | 100 | 100 | 100 | |
| coinpilott.io | 100 | 100 | 100 | 100 | 100 | 100 | |
| coinpllot.io | 100 | 100 | 100 | 100 | 100 | 100 | |
| coinplot.io | 100 | 100 | 100 | 100 | 100 | 100 | |
| cooinpilot.io | 100 | 100 | 100 | 100 | 100 | 100 | |
| koinpilot.io | 100 | 100 | 100 | 100 | 100 | 100 |
Who shares what · every shared server, certificate, registrant and more
Same server (address) · 3
| Value | Strength | Shared by |
|---|---|---|
| 198.51.100.77 Fast VPS LLC · hoster |
80% proof |
7 sites coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io |
| 198.51.100.78 Mock Hosting LLC · hoster |
80% proof |
7 sites coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io |
| 198.51.100.79 Mock Hosting LLC · hoster |
80% proof |
7 sites coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io |
TLS certificates · 1
| Value | Strength | Shared by |
|---|---|---|
| bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb | 80% proof |
7 sites coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io |
Registrants · 1
| Value | Strength | Shared by |
|---|---|---|
| ops@affnet-mail.example | 90% proof |
7 sites coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io |
Affiliate ids · 1
| Value | Strength | Shared by |
|---|---|---|
| atid=51803 | 95% proof |
7 sites coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io |
Redirect hosts · 1
| Value | Strength | Shared by |
|---|---|---|
| go-linkz.click | 60% a hint |
7 sites coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io |
Name servers · 2
| Value | Strength | Shared by |
|---|---|---|
| ns1.mock-dns.example | 10% common |
7 sites coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io |
| ns2.mock-dns.example | 10% common |
7 sites coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io |
Registrars · 1
| Value | Strength | Shared by |
|---|---|---|
| Mock Registrar LLC | 10% common |
7 sites coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io |
Bought together · 2
| Value | Strength | Shared by |
|---|---|---|
| Mock Registrar LLC · 2026-09-01 → 2026-09-03 | 30% a hint |
5 sites coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io |
| Mock Registrar LLC · 2026-02-25 → 2026-02-26 | 30% a hint |
2 sites coin-pilot.io, coinpilot-bot.io |
Same page code · 1
| Value | Strength | Shared by |
|---|---|---|
| page 2cefb68bc4 | 60% a hint |
7 sites coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io |
Pages that look the same · 1
| Value | Strength | Shared by |
|---|---|---|
| screenshot a8696e721b | 30% a hint |
7 sites coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io |
Favicons · 1
| Value | Strength | Shared by |
|---|---|---|
| 1130316202 | 10% common |
7 sites coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io |
Toolkit · what the attacker uses
| Kind | What |
|---|---|
| Registrars | Mock Registrar LLC ×7 |
| Hosting | Mock Hosting LLC (hoster) ×4Fast VPS LLC (hoster) ×3 |
| Redirect hosts | go-linkz.click ×7 |
| Name servers | ns1.mock-dns.example ×7ns2.mock-dns.example ×7 |
| Certificate issuers | C=US O=Mock Trust Services CN=MT1 ×7 |
When the domains were registered · a ring = several bought within days of each other
2026-02-252026-09-03
| Registered | Site |
|---|---|
| 2026-02-25 · in a wave | coinpilot-bot.io |
| 2026-02-26 · in a wave | coin-pilot.io |
| 2026-09-01 · in a wave | cooinpilot.io |
| 2026-09-02 · in a wave | coinplot.io |
| 2026-09-02 · in a wave | koinpilot.io |
| 2026-09-03 · in a wave | coinpilott.io |
| 2026-09-03 · in a wave | coinpllot.io |
Evidence per site · which site has which tie
| Site | affiliate id | registrant | certificate | ip | redirector | kit | batch | kit look |
|---|---|---|---|---|---|---|---|---|
| coin-pilot.io | atid=51803 | ops@affnet-mail.example | bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb | 198.51.100.77, 198.51.100.78, 198.51.100.79 | go-linkz.click | page 2cefb68bc4 | Mock Registrar LLC · 2026-02-25 → 2026-02-26 | screenshot a8696e721b |
| coinpilot-bot.io | atid=51803 | ops@affnet-mail.example | bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb | 198.51.100.77, 198.51.100.78, 198.51.100.79 | go-linkz.click | page 2cefb68bc4 | Mock Registrar LLC · 2026-02-25 → 2026-02-26 | screenshot a8696e721b |
| coinpilott.io | atid=51803 | ops@affnet-mail.example | bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb | 198.51.100.77, 198.51.100.78, 198.51.100.79 | go-linkz.click | page 2cefb68bc4 | Mock Registrar LLC · 2026-09-01 → 2026-09-03 | screenshot a8696e721b |
| coinpllot.io | atid=51803 | ops@affnet-mail.example | bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb | 198.51.100.77, 198.51.100.78, 198.51.100.79 | go-linkz.click | page 2cefb68bc4 | Mock Registrar LLC · 2026-09-01 → 2026-09-03 | screenshot a8696e721b |
| coinplot.io | atid=51803 | ops@affnet-mail.example | bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb | 198.51.100.77, 198.51.100.78, 198.51.100.79 | go-linkz.click | page 2cefb68bc4 | Mock Registrar LLC · 2026-09-01 → 2026-09-03 | screenshot a8696e721b |
| cooinpilot.io | atid=51803 | ops@affnet-mail.example | bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb | 198.51.100.77, 198.51.100.78, 198.51.100.79 | go-linkz.click | page 2cefb68bc4 | Mock Registrar LLC · 2026-09-01 → 2026-09-03 | screenshot a8696e721b |
| koinpilot.io | atid=51803 | ops@affnet-mail.example | bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb | 198.51.100.77, 198.51.100.78, 198.51.100.79 | go-linkz.click | page 2cefb68bc4 | Mock Registrar LLC · 2026-09-01 → 2026-09-03 | screenshot a8696e721b |
Also in common, but weak · they never group sites
| Kind | Value | Sites |
|---|---|---|
| the same favicon | 1130316202 | 7 |
| the same registrar | Mock Registrar LLC | 7 |
| the same name server | ns1.mock-dns.example | 7 |
| the same name server | ns2.mock-dns.example | 7 |
Confidence is the weakest tie that holds the group together. Every tie has a weight: how likely it is that two sites sharing it are one operation. A server on a CDN is no evidence; a registrar or a name server never ties two sites on its own. This report was generated from the evidence BrandWatch holds today; searching for more sites of this operation is a separate step the analyst starts.