cow[.]airdropalert[.]us

Analysis of cow.airdropalert.us reveals a confirmed phishing domain impersonating Google, classified as a high-risk crypto scam. The domain was registered on October 19, 2025, through Dynadot LLC and is currently offline. Infrastructure analysis shows it resolved to IP 172.253.63.105, hosted under AS15169 (Google LLC), though this IP association does not confirm legitimacy due to the domain's fraudulent purpose. Nameservers (brenna.ns.cloudflare.com, hassan.ns.cloudflare.com) indicate Cloudflare usage, a common tactic to obscure hosting origins and evade takedowns. No SSL certificate was detected, increasing vulnerability to interception and further signaling malicious intent.

The page title explicitly displayed 'Google,' aligning with the confirmed brand impersonation. Google Safe Browsing flags the domain for social engineering, and it appears on at least one security blocklist, including PhishDestroy. Gridinsoft assigned a trust score of 0/100, reinforcing its fraudulent classification. VirusTotal detections (11 of 93 vendors) provide additional evidence of malicious activity, though the absence of a full scan limits broader validation.

The domain's rapid takedown suggests either successful mitigation or evasion efforts by the threat actor. Defenders should treat this domain as compromised, block all resolutions, and monitor for re-emergence under similar naming schemes. Given the crypto scam classification, users should be alerted to potential wallet-draining or credential-harvesting risks associated with any prior interaction. Further investigation into the hosting infrastructure and registrar actions is recommended to prevent recurrence.