v2-cow[.]net

On July 24, 2026, analysts reviewed the domain v2-cow.net, which is classified as a generic phishing site and currently listed as offline. The domain was registered on February 21, 2026 through Web Commerce Communications Limited and uses the authoritative name servers ns100.webnic.cc and ns101.webnic.cc. DNS resolution points to the IP address 172.67.199.42, an address owned by Cloudflare, Inc. (AS13335) and located in the United States. No SSL/TLS certificate is presented for the host, indicating that HTTPS connections are not supported or have not been provisioned.

The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy filtering service. VirusTotal analysis shows that 10 of 93 scanned security vendors flagged the domain as malicious, reinforcing the phishing classification. No additional public threat intelligence sources such as Google Safe Browsing, Open Threat Exchange, or reputation scores were found for this host, and the page title or content has not been publicly disclosed.

The lack of HTTPS and the presence of a Cloudflare fronting service are common tactics to obscure the true hosting environment while leveraging reputable infrastructure. Defenders should continue to block outbound connections to 172.67.199.42 and add v2-cow.net to local deny lists, monitor for any re‑activation attempts, and watch for related subdomains that may be registered under the same registrar. Ongoing surveillance of the registrar’s new registrations and the associated name servers can help identify future phishing campaigns that reuse this infrastructure.