download-coinnomi[.]com

The domain download-coinnomi.com was registered on 21 Feb 2026 through Registrar.eu (Hosting Concepts B.V.) and resolves to 172.67.187.148, an address owned by Cloudflare (AS13335) in the United States. The zone is served by Cloudflare nameservers cosmin.ns.cloudflare.com and rosalie.ns.cloudflare.com, and the site presents a valid Google Trust Services / WE1 TLS certificate, indicating normal HTTPS termination. HTTP requests return a 301 redirect, but the final content has not been captured; the only visible indicator is the page title "Coinomi: The blockchain wallet trusted by millions," which suggests an attempt to impersonate the Coinomi wallet brand. The intelligence set classifies the site as a brand-impersonation campaign targeting "across," and the risk level is marked high. Reputation scoring from Gridinsoft is 0/100, and nine of ninety-three VirusTotal scanners have flagged the domain, confirming malicious intent. The domain appears on three independent blocklists and is already blocked by MetaMask, PhishDestroy, and SEAL. Current status remains active, indicating the infrastructure is still operational. Defenders should add the host to network deny lists, monitor DNS queries for the associated Cloudflare IP, and enforce URL filtering for the exact domain. Continuous re-scanning is advised to capture any payload changes, and any credential-capture infrastructure observed behind the redirect should be isolated.