coinomi[.]co[.]com

This domain is flagged as a high-risk cryptocurrency wallet phishing endpoint targeting users of legitimate wallet services. Analysis indicates the site was designed to harvest sensitive credentials, including private keys and recovery phrases, under the guise of a trusted platform. The threat type is classified as a generic_phishing campaign with a focus on cryptocurrency theft, a common vector for financial fraud. Infrastructure analysis reveals the domain coinomi.co.com was originally registered on August 16, 1997, through Moniker Online Services LLC, a registrar frequently associated with abused infrastructure. The domain resolves to the IP address 80.64.19.62, hosted on AS48031 (Ivanov Vitaliy Sergeevich) in Poland, an autonomous system with a history of hosting malicious endpoints. The site appears on five security blocklists, including PhishDestroy, Polkadot, Enkrypt, Codeesura, and PhishingDB. No SSL certificate was detected, further reducing its legitimacy. Detection engines on VirusTotal flagged the domain as malicious, with 17 out of 95 vendors confirming phishing activity. The page title, Attention Required! | Cloudflare, suggests an attempt to mimic security challenges or access restrictions to deceive users. Mitigation against this threat involves immediate blocking of the domain and its associated IP address (80.64.19.62) at the network perimeter. Users who may have interacted with the site should revoke any exposed credentials, particularly cryptocurrency wallet private keys or recovery phrases, and monitor accounts for unauthorized transactions. Organizations should update endpoint protection rules to include this domain and its IP in denylists. Due to the domain's long-standing registration, security teams should investigate potential historical abuse patterns and assess whether additional subdomains or related infrastructure remain active. Verification of wallet software should always occur through official channels, and users should be educated on recognizing phishing indicators, such as missing SSL certificates and mismatched domain names.