coinomi-i[.]icu

Analysis of the domain coinomi-i.icu indicates a high-risk cryptocurrency wallet phishing campaign targeting users of the Coinomi brand, as evidenced by the page title 'Coinomi' and its classification by multiple security vendors. The domain was registered on March 8, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with abusive registrations. Infrastructure analysis reveals the domain resolves to the IP address 188.114.96.3, hosted on Cloudflare's network (AS13335) in the United States, with nameservers syeef.ns.cloudflare.com and tess.ns.cloudflare.com. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of phishing sites leveraging legitimate certificate authorities to appear trustworthy.

Detection data shows the domain is flagged by 19 of 94 security vendors on VirusTotal, including PhishDestroy, MetaMask, and SEAL, and appears on three additional security blocklists. Gridinsoft assigns a trust score of 0/100, further corroborating its malicious classification. The site employs technologies such as jQuery, HSTS, Cloudflare Browser Insights, and HTTP/3, which are consistent with modern phishing infrastructure designed to evade detection and enhance performance. At the time of this report, the domain is offline, though its prior activity and detection history suggest it was actively used in a phishing operation.

Defenders should treat this domain as confirmed malicious and prioritize blocking it at the DNS and network levels. The use of Cloudflare hosting and a short registration window (approximately four months prior to the report date) aligns with common phishing lifecycle patterns, where domains are rapidly deployed and discarded. While the exact content of the phishing page remains unanalyzed, the combination of brand impersonation, detection by specialized cryptocurrency security tools, and low trust scores provides sufficient evidence for immediate remediation.