swap[.]cow-fl[.]com

This domain, swap.cow-fl.com, was registered on 21 February 2026 and is presently taken offline. Infrastructure analysis shows it resolves to the IP address 104.21.32.1, which belongs to Cloudflare, Inc. (ASN 13335) and is located in the United States. The use of a Cloudflare front‑end is typical for fast‑flux or anonymisation tactics, and it provides a valid SSL certificate identified as WE1, indicating that HTTPS connections were available when the site was active. Threat intelligence flags the domain as a crypto‑related scam.

VirusTotal scans have returned nine positive detections out of 93 submitted security vendors, confirming that multiple antivirus and URL‑reputation engines consider the domain malicious. The domain is listed on at least one public security blocklist and is actively blocked by the PhishDestroy service, reinforcing the assessment that it was used for phishing or fraud. No public safe‑browsing verdict, Open Threat Exchange (OTX) entry, or registrar information is supplied in the current data set.

Defenders should continue to deny any network traffic to 104.21.32.1 that originates from swap.cow-fl.com, enforce DNS sink‑hole rules for the domain, and ensure that web‑proxy or gateway filters reference the blocklist entry that already flags it. Because the site is offline, no live content can be examined; therefore, analysts should monitor the IP address for any re‑use and watch for new domains that resolve to the same Cloudflare edge node. Ongoing correlation with endpoint telemetry that reports the nine VirusTotal detections will help to surface any residual compromise attempts that may reference this infrastructure.