coinomiwalletdesktop[.]com

This domain is identified as a crypto drainer, a type of malicious infrastructure designed to automatically siphon cryptocurrency from victims' wallets upon interaction. The site impersonates Coinomi, a legitimate multi-currency wallet provider, by mimicking its desktop application download page. Users are tricked into downloading and executing malware that establishes unauthorized connections to their wallets, enabling attackers to drain funds without explicit transaction confirmation. The threat is particularly insidious due to its automation and irreversibility of cryptocurrency transactions. Analysis indicates the domain coinomiwalletdesktop.com exhibits multiple high-risk indicators. It is flagged by 13 out of 95 security vendors on VirusTotal, including detections for malicious behavior and phishing. The domain was registered on May 30, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with fraudulent domains. Infrastructure analysis reveals it resolves to the IP address 203.188.171.156 and is currently blocked by three major security blocklists, including MetaMask and PhishDestroy. The use of Nginx and HTTP/3 suggests an attempt to appear legitimate while maintaining operational efficiency for malicious purposes. Users who visited coinomiwalletdesktop.com or downloaded files from it should assume compromise. Immediately disconnect the device from the internet to prevent further data exfiltration. Do not interact with any cryptocurrency wallets or enter seed phrases on the affected device. Perform a full system scan using updated security tools to detect and remove malware. Reset all passwords and revoke access to any connected wallets or applications. Monitor all linked cryptocurrency wallets for unauthorized transactions and consider transferring remaining funds to a new, secure wallet. Report the incident to relevant security teams and consider filing a report with local cybercrime authorities.