cosmicvpn[.]net

The domain cosmicvpn.net is a confirmed phishing site engaged in brand impersonation targeting Google. It was designed to deceive users into believing they were interacting with a legitimate Google service, posing an elevated risk of credential theft or fraud. No crypto drainer kit was detected. As of the latest verification, cosmicvpn.net has been taken offline.

Technical analysis shows cosmicvpn.net was flagged by 2 of 95 security vendors on VirusTotal, including G-Data and Gridinsoft. It appeared on 2 security blocklists (PhishDestroy and ScamSniffer) but was not flagged by Google Safe Browsing. The domain was registered through NameSilo, LLC on July 10, 2025, and resolved to the IP address 142.250.185.228, hosted on Google LLC's infrastructure (AS15169). The SSL certificate was issued by Google Trust Services (WE1), and the observed page title was 'Google'. Technologies detected included Cloudflare and HTTP/3, with the site currently returning a 404 HTTP status.

Users who interacted with cosmicvpn.net should immediately change any passwords entered on the site, enable two-factor authentication (2FA) on their Google account, and monitor for unauthorized activity. Report the domain to Google’s phishing reporting tool and to platforms like PhishTank or the Anti-Phishing Working Group (APWG). If financial or sensitive data was exposed, consider contacting relevant institutions to secure accounts.