cowsvap[.]finance

Analysis of the domain cowsvap.finance reveals an active generic phishing infrastructure that has been taken offline as of the report date, July 22, 2026. The domain resolves to the IP address 82.25.81.58, which is assigned to AS47583 Hostinger International Limited and geolocated in the United States. No TLS certificate is present, and HTTP requests return a 409 Conflict page title, indicating the site is not serving legitimate content.

Registry data shows the domain was registered through Devexpanse Ltd d/b/a Regery.com, and the authoritative nameservers are sandra.ns.cloudflare.com and venkat.ns.cloudflare.com, both hosted by Cloudflare. Reputation scoring is extremely poor: Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single security blocklist. VirusTotal scans flagged the domain by 2 of 95 security vendors, and the phishing mitigation service PhishDestroy has also blocked it.

While the limited vendor detections suggest a low-profile campaign, the combination of a malicious registrar, absent SSL, low trust score, and blocklist entry warrants an elevated risk classification. Defenders should continue to block the domain at network perimeters, monitor DNS queries for the associated IP and nameservers, and update endpoint and web filtering solutions to reflect the current indicators. Further scrutiny of related domains using the same registrar or nameservers is recommended to uncover any broader malicious infrastructure.