cozymeta[.]com

Analysis of cozymeta.com, observed on July 25, 2026, indicates that the domain was created on April 09, 2026 and is currently taken offline. The site resolves to IP address 31.31.196.162, which is registered to AS197695 and geolocated to Russia. Registration was performed through the registrar July Name Limited, operating under REG.RU, Ltd. The page title returned by the server reads “Работа сайта временно приостановлена,” confirming that the site is not actively serving content. The domain appears on two public blocklists and has been explicitly blocked by the PhishDestroy and Enkrypt filtering services, reinforcing the perception of malicious intent.

AlienVault OTX references the domain in twelve separate threat pulses, suggesting that it has been observed in multiple campaigns or investigations. VirusTotal scans show that sixteen out of ninety‑three security vendors flagged the domain, indicating a non‑trivial detection rate across independent analysis engines. The SSL certificate is rated R10, and the Gridinsoft trust score is 0 out of 100, both of which denote an absence of trust. While the offline status prevents direct interaction, the convergence of registrar data, IP attribution, blocklist listings, OTX mentions, and vendor detections provides strong evidence that cozymeta.com was employed for generic phishing operations.

Uncertainty remains regarding the exact phishing kit or the specific victim demographics, as no payload samples or landing‑page screenshots have been released. Defenders should continue to block the domain at network perimeters, update endpoint and DNS filtering policies to include cozymeta.com, and monitor for any re‑activation attempts. Threat intelligence feeds should be refreshed to capture any future re‑use of the associated IP address or registrar footprint, and incident response teams should treat any residual artifacts referencing this domain as malicious.