bozei[.]cloud

The domain bozei.cloud was registered on February 24, 2026 through Gname.com Pte. Ltd. and is currently taken offline. DNS resolution points to the Cloudflare edge address 172.67.196.63, placing the infrastructure within AS13335 (Cloudflare, Inc.) and locating the service in the United States. The site presented a page title reading "Bozei: One-Stop Global Investment Platform | Forex | Commodities | Stocks | Indices | Cryptocurrencies | Gold | Oil," which aligns with the classified scam type of an investment scam and indicates an attempt to lure victims with financial product promises. The domain explicitly impersonates Apple, as noted in the threat intelligence, suggesting that any content or branding would have been designed to appear as an Apple‑related offering.

SSL is provided by Let’s Encrypt (certificate identifier YE2), offering a valid TLS connection but not mitigating malicious intent. Reputation checks show a Gridinsoft trust score of 28 out of 100, indicating low confidence in the domain’s legitimacy. VirusTotal analysis recorded 2 detections out of 91 scanning engines, confirming that a minority of security vendors flagged the site as malicious. The domain appears on three external blocklists and has been identified by PhishDestroy, MetaMask, and SEAL as a blocked resource, reinforcing its malicious classification.

AlienVault OTX references include two threat‑intel pulses that mention bozei.cloud, providing additional corroboration of its use in fraudulent campaigns. While the exact page content was not captured, the available metadata—page title, scam type, and Apple impersonation—suggests a targeted brand‑impersonation investment lure. Defenders should continue to block the domain at network and endpoint layers, monitor DNS queries for the associated Cloudflare IP range, and update detection signatures to include the observed SSL certificate and low Gridinsoft score.