cowswap[.]at

Analysis of the domain cowswap.at indicates it is actively involved in cryptocurrency-related fraudulent activity. Registered on March 13, 2026, through Virtualine, the domain resolves to the IP address 130.12.180.128, hosted on AS202412 (Omegatech LTD) in Germany. The domain is currently flagged by 12 of 91 security vendors on VirusTotal and appears in 24 threat intelligence pulses on AlienVault OTX, reflecting broad detection across multiple security platforms. It is also listed on three distinct security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, further confirming its malicious classification. The domain's SSL certificate is issued by Let's Encrypt (serial number E7), and it returns an HTTP 200 status, suggesting an operational and accessible phishing or scam page. Nameservers are configured to a.dnspod.com, b.dnspod.com, and c.dnspod.com, a pattern commonly observed in domains associated with malicious campaigns. The page title, 'cowswap.at,' does not provide additional context about the specific content or targeted brand, but the scam type is explicitly categorized as a crypto scam based on existing intelligence. Defenders should treat this domain as high-risk and implement blocking measures at the network and endpoint levels. Given its active status and consistent detection across multiple security sources, continued monitoring for related infrastructure or newly registered domains with similar patterns is recommended. No further details about the exact nature of the scam (e.g., fake exchange, wallet drainer, or token swap fraud) are available at this time, but the domain's association with cryptocurrency fraud is well-documented.