coinomi-cm[.]icu

Analysis of the domain coinomi-cm.icu, created on December 30, 2025, shows it is currently offline but was previously active as a generic phishing site targeting users of the Coinomi brand. The domain is registered through Gname.com Pte. Ltd. and resolves to the IP address 172.67.148.52, which belongs to Cloudflare, Inc. (AS13335) and is geolocated to the United States. The site presented a page title of "Coinomi" and was secured with an SSL certificate identified as WE1.

Threat intelligence indicates the domain appears on a single blocklist, specifically PhishDestroy, and has been flagged by 14 of 93 security vendors on VirusTotal. Additionally, Gridinsoft assigned a trust score of 0 out of 100, suggesting a high likelihood of malicious intent. The elevated risk level corresponds with the generic phishing classification, but no further details on the payload or credential harvesting mechanisms are available from the observed data.

Defenders should continue to block the domain at network perimeter devices, update URL filtering lists to include coinomi-cm.icu, and monitor for any resurgence of activity from the associated IP range. Given the Cloudflare hosting, any future re‑hosting attempts may leverage the same infrastructure, so ongoing surveillance of the IP address and associated ASN is recommended. The lack of additional intelligence, such as detailed content analysis or observed victim reports, leaves the full scope of the campaign uncertain, reinforcing the need for proactive preventive controls and rapid incident response should related traffic be detected.