Coinetic · Windows AI Security Manager
Coinetic is security software for Windows servers and PCs. It watches every connection and login attempt, recognises attackers by what they do, and locks them out of the Windows Firewall automatically - with an AI security analyst that explains it all and shows you the fix. So whether you are safe tonight is no longer luck.
Why now
Scanning the whole internet, guessing passwords, writing an exploit for last week's vulnerability - AI tools have made all of it cheap, fast and automatic. One person can now run thousands of attacks at once, around the clock, without getting tired.
What used to take a skilled person now takes a prompt. Every server with RDP, VPN, a web page or mail on the internet is on someone's list - including yours.
New holes are probed within days of being published. Bots try passwords, paths and ports non-stop, from new addresses every hour.
Probes look like normal traffic, spread over many addresses and services. A firewall that only follows fixed rules does not notice the pattern.
The answer is not more rules you write by hand. It is protection that recognises attackers by their behaviour and reacts by itself - and an AI on your side that tells you what is going on. That is Coinetic.
What Coinetic is - in 30 seconds
Every connection the Windows Firewall allows or blocks, every failed login (RDP, VPN, SQL, mail, SSH, VNC), every web server request.
Attackers by their behaviour: a scan across ports, a series of wrong passwords, a request for /.env, a flood of connections.
Automatically, through the Windows Firewall, for a week - longer when they return. Your LAN, VPN and trusted addresses never.
One window shows it all, alerts reach you by e-mail, and the AI explains any line in plain words.
This is Coinetic's navigation. Point at an entry to see what is behind it.
SERVER
Network Adapters
Ban List
Port Scans
Failed Logins
Web Server
IIS / Caddy / ...
VPN Users
Open Ports
Connections
LogYour computer - Coinetic runs on each one, with its own window and its own protection service.
Every network card and VPN connection: its addresses, network profile (Domain / Private / Public) and the rules that apply to it. Lock a profile so Windows cannot quietly switch it.
Every address Coinetic locked out: why, until when, and how often it came back after the ban. Edit, unban or whitelist in one click.
Scanners caught knocking on several ports or a trap port - with owner, country and the ports they tried.
Every wrong password on RDP, VPN, SQL, mail, SSH and VNC - counted per address, banned at your limit.
IIS, Caddy, nginx and Apache, found automatically: scanners, password bots and floods hitting your web server - and proof the log is really read.
Who is connected right now, from which country and device - and every account that may dial in.
Every port that is open on this computer, with the program behind it - and who can reach it through the firewall.
Every live connection in and out, with the program, the remote address and who owns it.
The live firewall log: allowed and blocked, filter by program, address, adapter or LAN / internet.
Measured on one of our servers
At the rate measured on one of our own machines: 7,317 unwanted inbound connections blocked in one hour - about two every second. And the attackers it banned do not give up: 15 of them came back 2,658 times in 33 hours.
Reason 1 of 12
The Windows Firewall blocks silently. Coinetic shows every allowed and blocked connection live, with the program behind it, who owns the address and where it comes from.
Reason 2 of 12
Windows tells you a connection was blocked - never which of its hundreds of rules did it. Coinetic does. Right-click any line in the log and fix it where you see it.
included in every plan
Blocked incoming TCP 192.168.11.40:52114 → 1433 sqlservr.exe rule: Block SQL from LAN
New rule - filled in from the packet
Reason 3 of 12
A bot that knocks on several ports in seconds is a scanner. Coinetic recognises it and bans the address for a week. Trap ports like 23 (Telnet) ban at the first knock.
included in every plan
| Time | Source | Owner | Ports | Action |
|---|---|---|---|---|
| 21:46 | 45.82.78.106 | Detai (SG) | 22, 23, 3389 | banned 1 week |
| 19:12 | 162.216.149.96 | Google (US) | 8443, 9200 | banned 1 week |
| 11:48 | 31.14.254.54 | Hydra (GB) | 21, 25, 110 | banned 1 week |
| 08:31 | 66.132.195.88 | Censys (US) | 23 | trap port - banned |
Reason 4 of 12
RDP, VPN, SQL Server, MySQL, PostgreSQL, Exchange, hMailServer, SSH, VNC: Coinetic reads every failed login and bans the address at your limit - as low as one wrong password.
| Source | Country | Service | Tries | Action |
|---|---|---|---|---|
| 103.130.146.19 | Turkey | RDP | 5 | auto-banned |
| 146.70.247.110 | UAE | VNC | 1 | auto-banned |
| 189.127.165.75 | Brazil | VPN (RRAS) | 3 | auto-banned |
| 192.168.11.40 | LAN | SQL Server | 2 | LAN - never banned |
Reason 5 of 12
A botnet guesses passwords from thousands of addresses, each trying only once or twice - banning one address at a time cannot keep up. Press Under Attack and Coinetic locks down for the hours that matter, then puts everything back by itself.
UNDER ATTACK mode is ON until 18:30
| What | Now |
|---|---|
| RDP, SSH, SQL, WinRM, VNC, SMB | closed to the internet |
| A wrong password from the internet | banned at once |
| PowerShell, certutil, mshta, curl | no internet |
| Website, mail, VPN | running |
| Your office, LAN, your own address | still open |
Since 14:30: 1,284 failed logins from 1,131 addresses · 1,131 banned · most attacked: administrator
Reason 6 of 12
Coinetic finds IIS, Caddy, nginx and Apache on its own and reads their logs. Whoever asks for /.env, /.git or tries path tricks is banned at once. Floods of connections too.
included in Pro and Pro + AI
C:\caddy\access.log - 18,402 requests read, last 2 s ago
| Source | Errors | Request | Action |
|---|---|---|---|
| 93.123.109.228 | 1 | 404 GET /.env | banned - attack pattern |
| 5.6.7.8 | 20 | 404 GET /wp-login.php | banned - 20 in 10 min |
| 104.16.1.1 | 3 | 404 GET /old.html | Cloudflare - not banned |
Reason 7 of 12
Malware has to talk out. With outbound control, every new program asks once - with a plain recommendation, who signed it and where it wants to go.
included in every plan
wermgr.exe → 135.234.160.244:443 (watson.events.data.microsoft.com)
Signed by: Microsoft Windows
Recommended: Allow (all) - signed by a verified publisher
Reason 8 of 12
Malware likes familiar names. Coinetic checks the digital signature of every program that listens on the network or wants to connect out - and tells you who really published it.
Same name, different folder, broken signature: the classic disguise - and the first thing Coinetic flags.
Reason 9 of 12
The security scan checks firewall profiles, open file sharing, risky defaults, dead and duplicate rules - and fixes what it can with one click. Reversible.
| Severity | Finding |
|---|---|
| HIGH | Outbound traffic is allowed by default |
| MEDIUM | SMB (445) reachable from the internet |
| MEDIUM | Allow rules for programs that no longer exist (3) |
| INFO | Duplicate firewall rules (4 extra copies) |
Fix selected
Reason 10 of 12
Who is connected, from which country and device, how they logged in, how much they transferred. Plus every account in Active Directory that may dial in - and which ones nobody used for months.
included in Pro and Pro + AI
| User | From | Country | Login | Connected |
|---|---|---|---|---|
| p.chlebana | 109.80.38.152 | Czechia | EAP-MSCHAP v2 · IKEv2 | 8 h 48 min |
| c.kock | 31.172.107.60 | Germany | MS-CHAP v2 · L2TP | 8 h 08 min |
2 accounts with VPN access not used for 90+ days
Reason 11 of 12
Coinetic AI
You see a strange address, a blocked program, a rule nobody remembers. Right-click it and ask. The AI reads this computer's Coinetic data itself, explains it in plain words, and tells you exactly what to do - here, on this machine.
/.env - the file where web apps keep passwords. That request alone is an attack pattern, so Coinetic banned it for a week at 21:51./.env really does not exist under your web root.findstr "93.123.109.228" C:\caddy\access.log
On every log line, ban, scan, failed login, port, rule, connection, adapter and VPN user. No copying, no explaining your setup.
Bans, the log, rules, connections, open ports, failed logins and web errors, VPN users, the security scan - you watch it work: "looked up: list_bans, recent_log".
It knows the Windows version, language, PowerShell and installed roles. Commands it gives you actually run here.
"Right-click › Ban this IP" instead of hand-made firewall rules that nobody tracks. Commands only where they are needed.
The AI can read, never change. It cannot block, unblock, delete or run anything - every decision stays yours.
No AI account, no API key, no extra software on your Server or PC. It comes with the plan and works from the first minute.
What people ask
Reason 12 of 12
One small program and a background service on top of the firewall you already have. It speaks Windows' own interfaces - never translated text - so it works in every language. Offline for a week? Protection keeps running.
Why we built it
Our own Windows servers - web, VPN, mail, remote access - were attacked day and night. The Windows Firewall blocked silently: we did not know who, how often, or whether anything got through. So we built the tool we were missing. These are the first problems it solved for us.
Remote access
The problem: the remote-control port had to stay reachable, and bots from around the world kept guessing the password - day and night, from new addresses.
What Coinetic did: it reads every failed VNC login and bans the address at the first wrong password. The ban list shows how often each one comes back: the most stubborn came back more than 700 times.
Web server
The problem: hundreds of short connections a minute from one hosting address. Port-scan protection never saw it - the web port is open on purpose.
What Coinetic did: it found the Caddy server and its log by itself. An address asking for /.env, where web apps keep their passwords, is banned after that one request - and so is anyone who floods the server with connections.
VPN
The problem: over the years, accounts collect VPN access - and nobody checks whether they are still used.
What Coinetic did: the VPN page lists everyone connected (from where, with which login method and tunnel) and every Active Directory account allowed to dial in. Two had not been used for 9 and 17 months - access that only an attacker would still need.
Firewall rules
The problem: Windows has two different programs called wermgr.exe. Allowing one quietly removed the other's rule - a loop of the same question.
What Coinetic did: it now keeps one rule per program path, repairs lost rules by itself, and its security scan finds duplicate rules and rules for programs that no longer exist.
Plans
Per computer. Every plan includes all updates while the subscription runs.
Workstations and simple servers
$20 / computer / year
or $50 for 3 years
Servers and PCs with VPN, web, SQL or mail
$60 / computer / year
or $150 for 3 years
An AI security analyst on every screen
$20 / computer / month
or $200 per year · $500 for 3 years
The 30-day trial includes everything in Pro + AI, with 50 AI questions (up to 10 a day) to try the analyst. One trial per computer and internet connection.
| Module | Essentials | Pro | Pro + AI |
|---|---|---|---|
| Firewall view: live log, rules, connections, ports, adapters | ✓ | ✓ | ✓ |
| Outbound control (asks once per program) | ✓ | ✓ | ✓ |
| Security scan with one-click fixes | ✓ | ✓ | ✓ |
| Port-scan detection, trap ports, auto-ban | ✓ | ✓ | ✓ |
| Failed logins: Windows / RDP | ✓ | ✓ | ✓ |
| Network profile lock | ✓ | ✓ | ✓ |
| Under Attack mode (one click: admin doors shut, ban at the first wrong password) | ✓ | ✓ | ✓ |
| Firewall change watch (reports and undoes changes made by other programs) | ✓ | ✓ | ✓ |
| Temporary allows (1 hour / 8 hours / until restart) | ✓ | ✓ | ✓ |
| Failed logins: VPN, SQL Server, MySQL, PostgreSQL, Exchange, hMailServer, SSH, VNC, FTP | – | ✓ | ✓ |
| Web server protection (IIS, Caddy, nginx, Apache) and connection flood | – | ✓ | ✓ |
| Under Attack mode starts by itself on a password attack from many addresses | – | ✓ | ✓ |
| VPN users: who is connected, from where, AD accounts | – | ✓ | ✓ |
| Alerts by e-mail / script, per-rule actions | – | ✓ | ✓ |
| AI access (MCP) for your own AI tools | – | ✓ | ✓ |
| Ask AI via the Coinetic AI service (30 questions / day) | – | – | ✓ |
| Updates | while subscribed | while subscribed | while subscribed |
Questions
You do not need one to start. During setup, click "30-day trial" on the license page and setup gets a trial key for this computer automatically - one trial per computer and internet connection. When you buy, the license is put on the same computer; nothing to reinstall.
No. It manages the Windows Firewall that is already built in: it reads its log, writes its rules and bans through it. Uninstalling Coinetic leaves the firewall working, including the rules and bans Coinetic made.
Windows 7 and later, and every Windows Server from 2008 R2 on, in any language.
Automatic protection stops: no new bans, no profile lock. Firewall rules and existing bans stay in place. Renew, and protection is back at once.
For the license check: the license key, a fingerprint of the computer (a one-way hash), its name and Windows version. Ask AI sends your question and the context only when you use it, and the AI can only read.
No. Cloudflare's addresses are never banned by the web and flood rules.
Yes. Contact us and we release the old computer; the key then works on the new one.
Tell us - we will add it. In Coinetic click Help › Request a feature: you get a ticket number, and what our customers need goes into the next updates, which every subscription includes.
Install Coinetic tonight and stop leaving your servers and PCs to luck.
Get Coinetic
Download and run CoineticSetup.exe as administrator. On the license page, click 30-day trial: setup requests a trial key for this computer by itself - everything included, nothing to fill in. One trial per computer and internet connection.
Like it? Buy a license and your trial turns into it - same computer, nothing to reinstall.