cowf[.]fi

The domain cowf.fi was registered on 18 June 2026 through Key-Systems GmbH. The authoritative nameservers are dakota.ns.cloudflare.com and evelyn.ns.cloudflare.com, indicating the use of a Cloudflare DNS service. Resolution points to the IPv4 address 104.21.17.252, which belongs to AS13335 owned by Cloudflare, Inc. The domain hosts an HTTPS service issued by Google Trust Services under the WE1 certificate, and an HTTP 301 redirect returns a page titled “Vercel Security Checkpoint”.

Threat intelligence sources have classified the site as a generic phishing conduit. It appears on three independent blocklists, specifically PhishDestroy, MetaMask, and SEAL, reflecting a consensus among disparate security communities. VirusTotal analysis recorded three positive detections out of ninety‑five scanned engines, reinforcing the suspicion. The Gridinsoft trust score is zero out of one hundred, and the overall risk rating is high while the operational status remains active.

Infrastructure analysis shows the site is delivered via Cloudflare’s edge network, a common choice for threat actors seeking rapid deployment and built‑in DDoS mitigation. The TLS handshake is valid, but the certificate chain originates from a public CA, offering no indication of malicious intent. The HTTP 301 response directs visitors to a page whose title mimics a legitimate security checkpoint, a tactic frequently employed to lend credibility to credential‑harvesting pages.

Defenders should block resolution of cowf.fi at the network perimeter and include the IP address 104.21.17.252 in deny lists. Monitoring for outbound connections to this host is advisable, as is the removal of any stored credentials that may have been submitted to the site. Continuous re‑evaluation is recommended because the domain remains active and could evolve its payload or hosting configuration.