cow[.]airsdropalert[.]sbs

Analysis of the domain cow.airsdropalert.sbs, observed as offline at the time of reporting on 23 July 2026, shows multiple indicators consistent with a high‑risk brand‑impersonation campaign targeting Facebook. The domain was registered through Dynadot LLC and created on 5 November 2025. DNS resolution points to the IP address 172.253.63.104, which belongs to AS15169 owned by Google LLC and is located in the United States. The domain is served by Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, yet it does not present an SSL/TLS certificate, leaving the HTTP connection unencrypted. VirusTotal records indicate that 15 of 95 scanning engines have flagged the domain, reinforcing the suspicion of malicious activity.

Google Safe Browsing classifies the site under the “social engineering” category, and PhishDestroy has already added the domain to its blocklist. The site appears on one additional security blocklist, and Gridinsoft assigns a trust score of 0 / 100, the lowest possible rating. The page title returned from the HTTP response is “Google”, which does not correspond to the claimed impersonated brand, Facebook, suggesting that the content may have been altered or is not yet captured. No further page content has been publicly disclosed, and the lack of HTTPS prevents verification of any credential‑harvesting forms.

Uncertainties remain regarding the exact payload or phishing kit used, as no malware hashes or sandbox analyses are available. The offline status prevents real‑time interaction, but the infrastructure—Google‑owned IP, Cloudflare DNS, and a registrar known for rapid domain provisioning—matches patterns observed in other brand‑impersonation operations. Defenders should add cow.airsdropalert.sbs to URL filtering and endpoint protection rules, monitor DNS queries for the associated IP and name servers, and block HTTP requests to the domain.