app[.]cowsawp[.]run

This domain, app.cowsawp.run, is flagged as an active phishing infrastructure that was taken offline on July 24, 2026. Analysis indicates the domain was registered through Cloudflare, Inc. and resolved to the IP address 188.114.97.3, part of Cloudflare’s network (AS13335). The SSL certificate was issued by Google Trust Services (WE1), a detail that does not inherently indicate malicious intent but is consistent with modern phishing campaigns leveraging legitimate certificate authorities. The domain was detected by 13 of 95 security vendors on VirusTotal, a notable detection rate that aligns with elevated risk classifications. It also appears on at least one security blocklist and is blocked by PhishDestroy, further corroborating its malicious classification.

The page title, 'Index of /', suggests an exposed directory listing, which is a common artifact of hastily deployed phishing kits or misconfigured servers. This does not confirm the exact nature of the phishing content but indicates poor operational security, often observed in low-sophistication campaigns. No specific brand, scam type, or phishing kit was identified in the available data, so the precise target of the phishing attempt remains unconfirmed. Technologies detected include Cloudflare’s infrastructure and HTTP/3, which are frequently used by both legitimate and malicious actors to evade detection and improve performance. Defenders should treat this domain as a confirmed phishing threat.

The IP address 188.114.97.3 and associated Cloudflare ASN (13335) should be monitored for further malicious activity, as threat actors often reuse hosting infrastructure. Network-level blocking of the domain and IP is recommended until further analysis confirms its complete remediation. Given the domain’s current offline status, no immediate user interaction is expected, but historical logs should be reviewed for prior connections.