cow[.]airdropsalert[.]lol

This investigation documents the domain cow.airdropsalert.lol, which was observed targeting the Google brand through a fake airdrop narrative. The domain was registered on 18 October 2025 via Dynadot LLC and currently resolves to the IP address 216.58.212.132, an address owned by Google LLC (ASN 15169) in the United States. The use of a legitimate Google IP is a common tactic to lend credibility to malicious pages. The authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating Cloudflare DNS services. No TLS certificate was presented for the site, and the HTTP status at the time of analysis is not available because the domain has been taken offline.

The page title returned by the server is simply “Google”, matching the declared brand target. Reputation services uniformly rate the domain as highly suspicious. Gridinsoft assigns a trust score of 0 out of 100, while Scamadviser reports a score of 1 out of 100. The site is listed on a single security blocklist and has been actively blocked by the PhishDestroy service. VirusTotal analysis shows that 13 of 95 scanned engines flagged the domain as malicious, and Google Safe Browsing categorises it under social‑engineering threats.

The evidence points to a classic brand‑impersonation scheme that lures victims with promises of free airdrops, leveraging the Google name to harvest credentials or install malware. Because the domain is currently offline, immediate mitigation focuses on preventive controls. Defensive operators should add cow.airdropsalert.lol to DNS‑based deny lists, update web‑filtering rules to block the domain and any future sub‑domains, and monitor the associated IP range for newly registered domains that resolve to the same Google‑owned address. Continuous observation of the Cloudflare name servers may reveal re‑registration attempts. Analysts should also correlate any inbound traffic logs for connections to 216.58.212.