global[.]coinomiwallet[.]cc

Analysis of global.coinomiwallet.cc shows a high‑risk crypto‑drainer infrastructure that has been taken offline as of the report date. The domain was registered through Dynadot LLC on August 26, 2024 and points to the Cloudflare address 172.67.161.207, which is announced by AS13335 Cloudflare, Inc. in the United States. The site resolves without TLS; no SSL certificate is presented, and an HTTP request returns status code 200, indicating that a web server is actively responding. The page title returned by the server is "SEO AC," offering no further context about the content or intent of the site.

VirusTotal has recorded 11 detections out of 95 scanned engines, confirming that multiple security vendors consider the domain malicious. It appears on a single external blocklist and is explicitly listed by PhishDestroy as blocked. Google Safe Browsing flags the domain for social engineering, reinforcing the assessment that the site is used to deceive users. Gridinsoft’s trust scoring system assigns a zero‑out‑of‑one‑hundred rating, reflecting an extreme lack of trust.

The threat classification supplied is "Crypto Scam," consistent with the broader category of crypto‑draining operations that aim to exfiltrate digital assets from victims. Although the exact phishing page content has not been captured, the combination of a non‑TLS endpoint, malicious detections, and social‑engineering labeling provides sufficient evidence for defensive action. Defenders should continue to block the domain at network perimeters, update DNS filtering rules, and ensure that any endpoint protection solutions include the identified hash of the domain’s IP address. Monitoring for re‑registration of the same second‑level domain or similar sub‑domains under the same registrar is advisable, as adversaries often re‑deploy after takedown.