cowerswap[.]eu[.]com

The domain cowerswap.eu.com is currently active and classified as a high‑risk generic phishing site with a specific crypto‑scam focus. Registration data shows it was created on 21 February 2026 by Instra Corporation Pty Ltd. The authoritative name servers are ns1.centralnic.net through ns4.centralnic.net, and the domain resolves to IP 172.67.167.241, which belongs to AS13335 Cloudflare, Inc. in the United States. TLS is provided by Google Trust Services under the WE1 certificate, and the web server returns HTTP 521 (Web server is down) with a page title reporting “cowerswap.eu.com | 522: Connection timed out”. Cloudflare and HTTP/3 are detected as underlying technologies. The domain appears on one security blocklist and is listed by PhishDestroy. VirusTotal analysis shows a single detection out of 93 scanners. Gridinsoft assigns a trust score of 0 / 100. While the site is not reachable at the time of observation, the infrastructure indicates deliberate use of Cloudflare’s edge network to hide origin. Defenders should add the domain and its IP to blocklists, monitor DNS queries for the listed name servers, and consider sinkholing traffic to mitigate potential phishing or credential‑stealing campaigns. Further investigation is required to determine the exact payload or phishing page content, as the current HTTP response only indicates a timeout.