cow[.]airdrpalerts[.]sbs

Analysis of cow.airdrpalerts.sbs shows a newly created domain (registered on October 25, 2025) that is actively impersonating Google. The registrar listed is Dynadot LLC and the authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. The domain resolves to IP address 142.250.186.164, which belongs to AS15169 owned by Google LLC and is located in the United States. This suggests the attacker is pointing the malicious host to a legitimate Google IP range, a technique that can bypass some network‑level filters. No SSL certificate is presented, meaning any interaction would occur over unencrypted HTTP. The page title returned from the server is simply "Google," matching the declared brand target.

Reputation signals are strongly negative: the domain appears on one security blocklist, is listed as blocked by PhishDestroy, and receives a Gridinsoft trust score of 0 out of 100. VirusTotal scans show five of ninety‑five security vendors flagging the domain, reinforcing the malicious assessment despite the relatively low detection count. The current operational status is offline, indicating the site has been taken down or is no longer serving content.

Uncertainties remain regarding the exact payload or phishing kit used, as no further content analysis or URL paths are available. Defenders should continue to block the domain at DNS and web‑filter layers, monitor for any re‑hosting attempts, and consider adding the domain to internal blocklists. Because the IP belongs to Google’s infrastructure, security solutions that rely solely on IP reputation may miss this threat; therefore, correlation with domain‑level indicators such as the registrar, name servers, and the lack of TLS should be employed. Continuous monitoring of threat‑intel feeds for any resurgence of the domain or related subdomains is recommended.