bozei[.]xin

Analysis indicates that the domain bozei.xin is actively engaged in phishing operations targeting financial services, specifically posing as a multi-asset investment platform. The domain was registered on January 7, 2026, through Gname.com Pte. Ltd. and currently resolves to the IP address 172.67.202.207. The page title, 'Bozei: One-Stop Global Investment Platform | Forex | Commodities | Stocks | Indices | Cryptocurrencies | Gold | Oil,' suggests an attempt to deceive users into believing the site offers legitimate trading services across multiple asset classes. Infrastructure analysis reveals that the domain is flagged by 6 of 95 security vendors, as recorded in available scans, and appears on four distinct security blocklists. Threat intelligence platforms report its presence in 17 pulses, further corroborating its malicious classification. The domain is actively blocked by multiple security mechanisms, including browser-based protections and transaction monitoring systems. The SSL certificate is issued by Google Trust Services, which may lend an appearance of legitimacy but does not mitigate the underlying threat. Defenders should treat this domain as high-risk and prioritize its inclusion in deny lists, web filtering rules, and endpoint protection policies. Given its active status and consistent detection across multiple sources, organizations should monitor for any internal access attempts or related network traffic. The exact content and functionality of the site remain unanalyzed, but the available evidence confirms its role in a phishing campaign targeting financial or investment-related credentials. No additional brand-specific targeting or scam subtype is currently verified beyond the generic investment platform classification.