coinomize[.]co

This domain was identified as a generic phishing site. The visible page title "Captcha Protection - Coinomize" suggests a defensive page, but the domain is listed by multiple anti‑phishing services. Coinomize.co was registered on 18 November 2019 through NETIM SAS and uses the nameservers ns1.ddos-guard.net and ns2.ddos-guard.net. The authoritative IP address 185.178.208.78 belongs to AS57724 DDOS‑GUARD LTD and resolves to a server located in Russia. The host presents a Let’s Encrypt R12 certificate and returns HTTP 200, indicating an active web service at the time of capture.

Technical fingerprints include AMP, jQuery, HSTS, Google Analytics and the DDoS‑Guard protection kit. Gridinsoft assigned a trust score of 0 out of 100, reflecting a lack of confidence in the site’s legitimacy. VirusTotal recorded detections from 2 of 95 scanned security vendors, and the domain appears on three independent blocklists. It is also blocked by PhishDestroy, MetaMask and SEAL, reinforcing the phishing classification.

The site has been taken offline, so live content cannot be verified; the only concrete indicator is the page title, which does not reveal the phishing payload or targeted service. Defenders should continue to block coinomize.co at DNS and proxy layers, add its IP 185.178.208.78 to firewall deny lists, and monitor for other domains hosted on the same DDoS‑Guard nameservers or IP range. Updating IDS/IPS signatures with the observed technology stack and the low trust score can help catch similar recreations. Because the registration date predates the recent activity, threat actors may reuse the domain or create clones; continuous threat‑intel feeds should be consulted for re‑appearance.