coinomei-wallet[.]webflow[.]io

Analysis of coinomei-wallet.webflow.io shows a domain that was actively used for a crypto drainer operation before being taken offline. The site returned an HTTP 404 status with the page title "404 - Page not found," indicating that the malicious payload has likely been removed or the hosting was terminated. The domain resolves to IP address 104.18.36.248, which belongs to AS13335 Cloudflare, Inc. and is located in the United States. Cloudflare’s DNS services are confirmed by the authoritative nameservers lamar.ns.cloudflare.com and journey.ns.cloudflare.com, and the site was served over HTTPS using a Google Trust Services certificate (WE1).

Network fingerprinting reveals the use of HTTP/3, a protocol commonly adopted by legitimate services but also leveraged by threat actors to obfuscate traffic patterns. VirusTotal records show that two of ninety‑five scanning engines flagged the domain, providing limited but corroborating evidence of malicious activity. The domain appears on a single security blocklist and is actively blocked by PhishDestroy, reinforcing its classification as a crypto‑related scam. Registration data indicates the domain was created on May 08, 2013 through MarkMonitor, Inc., a registrar often associated with high‑value brand protection, suggesting the attacker may have deliberately selected a long‑standing domain to increase perceived legitimacy.

While the current HTTP response is a generic 404 page, the historical presence of a crypto drainer profile, combined with the observed infrastructure, warrants continued monitoring. Defenders should add both the domain and its hosting IP to blocklists, enforce outbound traffic controls to prevent connections to the IP, and watch for any re‑registration or redeployment of the domain. Additional telemetry from DNS query logs and SSL certificate monitoring can help detect future attempts to resurrect the site under a similar infrastructure.