cohezo[.]app

Analysis of cohezo.app shows a newly registered domain (created March 26 2026) hosted behind Cloudflare infrastructure (IP 104.21.14.4, nameservers dara.ns.cloudflare.com and lennon.ns.cloudflare.com). The site presents the title “Cohezo – Where Teams Come Together” and serves a valid Let’s Encrypt certificate (E7). Threat intelligence flags the domain as high‑risk and active. It appears on three public blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, indicating prior association with phishing campaigns. AlienVault OTX references the domain in 22 separate pulses, and VirusTotal records five detections out of 94 scanned vendors, reinforcing the concern. Gridinsoft assigns a trust score of 0 / 100, further suggesting malicious intent. The combination of recent creation, cloud‑based hosting, multiple blocklist listings, and detection by several security vendors points to a likely phishing operation targeting users under the guise of a collaboration platform. Uncertainty remains regarding the exact payload or credential‑harvesting mechanisms, as the page content has not been examined. Defenders should block or quarantine cohezo.app at the network perimeter, monitor DNS queries for the domain, and advise users to avoid any unsolicited communications referencing Cohezo. Continuous re‑scanning is recommended to detect any evolution in the threat profile.