cow[.]app-airdropalert[.]lat

PhishDestroy has identified cow.app-airdropalert.lat as an elevated-risk threat, specifically a brand impersonation scam targeting Google users. This domain was designed to deceive visitors by mimicking Google's official login interface, potentially stealing credentials or delivering malware. Its offline status suggests it may have been taken down after malicious activity was detected, but similar domains could still be active.

Technical analysis reveals that the domain was created on November 10, 2025, and is registered through Dynadot LLC. It resolves to IP address 142.250.176.196, which may be associated with other fraudulent operations. VirusTotal data shows that 13 out of 95 security vendors flag this domain as malicious, and it already appears on one security blocklist. The domain lacks an SSL certificate, making any data transmitted insecure. Despite its short lifespan, the domain was fully set up to impersonate Google, as evidenced by its page title "Google."

Users should avoid interacting with cow.app-airdropalert.lat or any similar unsolicited links. To protect against Google impersonation scams, always verify the URL in your browser's address bar before entering credentials. Use official Google login pages only, enable two-factor authentication, and report suspicious domains to PhishDestroy. If you have already entered information on this domain, change your passwords immediately and monitor accounts for unauthorized activity.