cow[.]airdropsalert[.]us

Analysis of cow.airdropsalert.us indicates a high‑risk brand‑impersonation campaign targeting Google users. The domain was registered through Dynadot LLC on October 18, 2025 and resolves to IP address 142.251.151.119, which belongs to AS15169 owned by Google LLC and is located in the United States. Despite the legitimate‑looking hosting, the site presents a page titled "Google" and is classified as a crypto‑scam, suggesting it attempts to lure victims with fraudulent cryptocurrency offers while masquerading as an official Google service. VirusTotal reports that 13 of 93 security vendors have flagged the domain, and Google Safe Browsing has listed it for social engineering.

The domain appears on a single public blocklist and has been blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. No SSL certificate is associated with the host, and the current status is offline, preventing direct inspection of the site’s content or behavior. Nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating the use of Cloudflare’s DNS infrastructure.

Defenders should immediately add cow.airdropsalert.us to network deny lists, update intrusion‑detection signatures to match the observed IP and domain pattern, and monitor DNS query logs for any resolution attempts. Because the domain resolves to a Google‑owned IP range, care should be taken to avoid false positives for legitimate Google traffic; however, the combination of brand impersonation, crypto‑scam labeling, multiple vendor detections, and a zero trust score warrants aggressive blocking. Continuous threat‑intel feeds should be consulted for any re‑appearance of similar subdomains, and security teams should educate users about unsolicited cryptocurrency offers that claim to originate from Google.