cow[.]airdrpsalert[.]lat

Analysis of the domain cow.airdrpsalert.lat confirms it as a phishing site impersonating Google, with elevated risk indicators and confirmed takedown. The domain was registered on October 26, 2025, through Dynadot LLC and resolved to the IPv6 address 2607:f8b0:4004:c07::68, hosted on Google LLC's infrastructure (AS15169) in the United States. Cloudflare nameservers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com) were in use, though no SSL certificate was detected. The page title was explicitly set to 'Google,' aligning with the confirmed brand impersonation classification.

Detection data reveals the domain was flagged by 14 of 95 security vendors on VirusTotal and appeared on at least one security blocklist, including a block by PhishDestroy. Gridinsoft assigned a trust score of 0/100, further corroborating malicious intent. As of July 23, 2026, the domain is offline, likely due to enforcement action. The absence of an SSL certificate and the use of Cloudflare nameservers are consistent with low-effort phishing infrastructure, though the hosting on Google's network may have been leveraged to evade initial scrutiny.

Defenders should treat this domain as confirmed malicious, particularly in contexts where Google brand impersonation is a known threat vector. The combination of a recent registration date, explicit brand targeting, and detection by multiple vendors justifies blocking or monitoring the domain in security controls. While the exact phishing kit or payload remains unanalyzed, the observable infrastructure and detection history provide sufficient evidence for classification as a phishing site. No additional scam-specific details (e.g., credential harvesting, fake login forms) are available from the provided data.