cow[.]airdrpsalert[.]cfd

Analysis of the domain cow.airdrpsalert.cfd indicates a brand‑impersonation campaign targeting Google users. The domain was registered on 22 October 2025 through Dynadot LLC and currently resolves to the IP address 142.250.72.100, which is announced by AS15169 Google LLC and located in the United States. Despite the IP belonging to Google, the domain name bears no legitimate association with the corporation and is not covered by any SSL certificate, exposing any traffic to potential interception. The authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, both operated by Cloudflare, a common choice for threat actors seeking rapid DNS propagation and DDoS mitigation.

The page title returned from the site is simply "Google", matching the declared brand target. The infrastructure has been flagged by PhishDestroy and appears on a single security blocklist. VirusTotal reports that 10 of 95 security vendors have identified the domain as malicious, reinforcing the suspicion of phishing activity. Gridinsoft assigned a trust score of 0 out of 100, indicating an extremely low confidence in the domain’s legitimacy.

Given the offline status at the time of assessment, active probing of the site is not possible, and the exact content served remains unverified. Nevertheless, the convergence of multiple indicators—brand impersonation, lack of TLS, low trust score, vendor detections, and blocklist presence—supports a high confidence rating that the domain was used for malicious purposes. Defenders should continue to block the domain at perimeter filters, update internal blocklists, and monitor the associated IP address for any resurgence of activity. Additional vigilance is advised for any DNS queries to the Cloudflare name servers listed, as they may be leveraged for future campaigns.