cozleco-claim[.]pages[.]dev

This domain, cozleco-claim.pages.dev, is actively flagged as part of a crypto drainer phishing operation targeting users through a fake airdrop scheme. Registered on April 5, 2026, and hosted under Cloudflare’s infrastructure, the domain resolves to IP 172.66.47.187 (Cloudflare, Inc., CA) and uses nameservers damian.ns.cloudflare.com and emily.ns.cloudflare.com. The page title, 'Cozleco Network - The Fastest Blockchain and Powerful DEX - Built for Future!', suggests an attempt to impersonate a legitimate decentralized exchange or blockchain platform, though no confirmed brand association has been established beyond this self-reported label. Analysis indicates the domain is currently active, returning an HTTP 200 status, and is blocked by at least one security vendor (PhishDestroy). Gridinsoft assigns it a trust score of 0/100, reinforcing its malicious classification. VirusTotal reports 3 of 94 security vendors flagging the domain, though this detection rate is not conclusive evidence of its full scope or sophistication. The SSL certificate is issued by Google Trust Services (WE1), a common feature of both legitimate and malicious Cloudflare-hosted domains. Infrastructure analysis reveals no evidence of a custom phishing kit or advanced evasion techniques, though the use of Cloudflare’s free tier (pages.dev) is consistent with low-cost, disposable phishing infrastructure. The domain’s creation date aligns with typical phishing campaign lifecycles, where domains are registered shortly before deployment. Defenders should treat this domain as high-risk, particularly for users engaging with cryptocurrency or decentralized finance platforms. Blocking resolution at the DNS level or via endpoint protection is recommended, alongside monitoring for related subdomains or IP reuse under Cloudflare’s network. Further investigation into wallet addresses or transaction patterns associated with this drainer may provide additional indicators of compromise.