cow[.]airdropsalert[.]icu

Analysis of cow.airdropsalert.icu indicates a high‑risk brand‑impersonation campaign that masquerades as a Google‑related airdrop. The domain was registered through Dynadot LLC on 17 October 2025 and resolves to the IP address 142.250.186.132, which is owned by Google LLC (AS15169) and geolocated in the United States. The authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, both belonging to Cloudflare, suggesting the operator leveraged a reputable CDN to increase availability and conceal origin. The site presents the page title "Google," matching the declared brand target, but no SSL certificate was observed, leaving the connection unencrypted.

Trust metrics are extremely low: Gridinsoft assigns a score of 0 / 100 and Scamadviser a score of 1 / 100, confirming the malicious nature of the infrastructure. Google Safe Browsing flags the domain for social engineering, and it appears on one security blocklist. PhishDestroy has already taken the site offline, and VirusTotal reports that 15 of 95 scanned security vendors flag the domain as malicious, reinforcing the detection confidence.

Current uncertainty includes the exact phishing kit or payload delivered, as no content analysis beyond the page title is available. Defenders should add the domain and its resolved IP to blocklists, monitor for any new sub‑domains under the same registrar or name‑server pair, and enforce strict outbound filtering for traffic to the IP range owned by Google’s AS15169 when associated with unsolicited airdrop communications. Continuous enrichment of threat intel feeds with this indicator will help surface similar impersonation attempts targeting Google or other high‑profile brands.