cow[.]airdropalerts[.]pro

Analysis of cow.airdropalerts.pro, observed as offline as of 25 July 2026, indicates that the domain was registered on 27 November 2025 through Dynadot LLC and subsequently used to host a crypto‑focused brand‑impersonation campaign targeting Google. The site resolved to IP address 142.251.141.68, which belongs to AS15169 Google LLC and is geolocated in the United States. Hosting on a Google‑owned address suggests an attempt to leverage legitimate infrastructure to increase credibility. The domain employed Cloudflare’s authoritative nameservers (alex.ns.cloudflare.com and randall.ns.cloudflare.com) but did not present an SSL/TLS certificate, leaving the connection unencrypted. Page metadata returned a title of “Google,” aligning with the declared brand target and confirming the intent to masquerade as a Google service.

Security telemetry shows the domain appears on a single blocklist and was actively blocked by PhishDestroy. VirusTotal scans recorded nine detections out of ninety‑three scanners, indicating moderate consensus among anti‑malware engines that the site is malicious. The Gridinsoft trust score of 0 / 100 further reinforces the low confidence in the domain’s legitimacy. Uncertainty remains regarding the exact payload delivered to victims, as no sample of the hosted content has been captured and the site is currently offline.

Consequently, the full scope of the cryptocurrency scam—whether it involved credential harvesting, wallet address substitution, or other financial fraud—cannot be conclusively determined. Defenders should continue to monitor the associated IP address for any resurgence of malicious activity, enforce blocklisting of the domain across DNS filtering solutions, and ensure that any inbound traffic to the IP is inspected for anomalous behavior. Organizations using Google services should educate users about the absence of TLS on this domain and reinforce verification of legitimate Google URLs.