# co2nex.com — SUSPICIOUS

> co2nex.com is a live crypto drainer site with 0/95 VirusTotal detections. It impersonates CO2NEX brand to steal crypto assets. Stop interaction immediately.

## Summary
PhishDestroy identifies co2nex.com as an active crypto drainer domain registered on July 04, 2025 through HOSTINGER operations, UAB. The site leverages a fake CO2NEX brand facade to trick users into connecting wallets and signing malicious transactions that drain crypto assets. No publicly known drainer kit has been confirmed yet, but the domain’s recent creation and rapid deployment suggest a fresh, high-risk campaign targeting cryptocurrency users.

Technical indicators show a clean VirusTotal score of 0/95 detections, evading current antivirus coverage. The domain resolves to IP 104.21.10.177 and holds a valid Google Trust Services SSL certificate, adding false legitimacy. Registered via HOSTINGER operations, UAB with a July 2025 creation date, this domain has not yet been blocklisted by major security services, allowing it to remain active and operational.

Current status remains active with no takedown actions observed. Users are strongly advised to avoid visiting co2nex.com and report the domain to their security teams. Remaining risk is high due to active operation, lack of detections, and brand impersonation targeting crypto wallets.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2025-07-04 13:26:16
- Registrar: HOSTINGER operations, UAB
- IP: 104.21.10.177

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/6b2f6575-465b-4dfe-b2ad-6b62f76274f5
- PhishDestroy: https://phishdestroy.io/domain/co2nex.com/
- LLM endpoint: https://phishdestroy.io/domain/co2nex.com/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/co2nex.com/
Last updated: 2026-03-29