cow-fi[.]org

Analysis of cow-fi.org indicates the site was created on March 22, 2026 and is currently taken offline. The domain is registered through Dynadot Inc and resolves to the IPv4 address 130.12.180.128, which is hosted by Virtualine Technologies in the Netherlands. The authoritative nameservers are ns1.dyna-ns.net and ns2.dyna-ns.net. TLS termination is provided by a Let’s Encrypt certificate (identifier E7), confirming the use of a valid, publicly trusted SSL chain despite the malicious intent.

The page title returned by the server is literally "cow-fi.org", offering no additional context on the content. Gridinsoft assigns a trust score of 0 out of 100, reflecting extreme risk. The domain appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, consistent with its classification as an investment‑scam phishing operation. VirusTotal scans show five of ninety‑four security vendors flagging the domain, corroborating the presence of malicious indicators.

While the site’s offline status limits immediate threat reach, the infrastructure – including a newly registered domain, low‑trust scoring, blocklist presence, and partial vendor detections – suggests it was used in a recent investment scam campaign. Defenders should continue to block the domain at network perimeters, monitor DNS queries for 130.12.180.128 and the associated nameservers, and update endpoint protection signatures to reflect the current detection count. Given the limited publicly available content, analysts should treat any future re‑hosting of the domain as suspicious and prioritize investigation of related traffic patterns or associated phishing kits that may be redeployed.