cow[.]airdrpsalerts[.]life

On 23 July 2026 the domain cow.airdrpsalerts.life was observed actively serving content that claims to represent Google, as indicated by the page title “Google” and the classification as a Google brand impersonation. The site resolves to the IP address 142.250.185.68, which belongs to AS15169 owned by Google LLC and is located in the United States. Despite the IP belonging to Google’s infrastructure, the domain is hosted behind Cloudflare, Inc., as evidenced by the registrar information and the presence of Cloudflare‑provided technologies such as Cloudflare Browser Insights, HTTP/3 support, and the Cloudflare edge network. The TLS certificate presented is issued by Google Trust Services under the WE1 name, matching the legitimate Google certificate chain, which may increase the perceived legitimacy of the page. A HTTP request to the host returns a 502 status code, indicating a bad gateway condition that may be used to obscure the underlying content or to redirect victims.

No authoritative nameserver records could be retrieved for the domain, listed as NS_NOT_FOUND, suggesting the use of dynamic or obscured DNS configuration. The page is built with common front‑end libraries including Bootstrap and jQuery, a pattern frequently observed in phishing kits. The domain appears on one external security blocklist and has been actively blocked by the PhishDestroy sinkhole, confirming that threat‑intelligence feeds have identified it as malicious. VirusTotal analysis reports that seven of ninety‑five scanning engines flag the domain, providing additional corroboration of its malicious nature.

No further public safety‑browser checks are listed, but the combination of blocklist presence, certificate spoofing, and brand impersonation warrants a high risk rating. Defenders should add cow.airdrpsalerts.life to URL filtering and domain block policies, monitor DNS queries for the domain, and consider raising alerts on any outbound connections to the associated IP address.