cow[.]app-airdropalert[.]lol

The domain cow.app-airdropalert.lol was registered on November 10, 2025 through Dynadot LLC and is currently taken offline. DNS resolution points to IP address 172.217.18.4, an address owned by Google LLC (AS15169) in the United States. The domain uses Cloudflare name servers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com) but does not present an SSL/TLS certificate, leaving the HTTPS handshake undefined.

Public scanning on VirusTotal recorded 14 detections out of 95 security vendors, indicating a moderate level of consensus among scanners that the site is malicious. The page title returned during the brief live window was simply "Google," matching the declared brand target and confirming that the site was designed to impersonate Google. Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on a single external blocklist.

PhishDestroy has already blocked the domain, and the overall risk rating is elevated. Defenders should continue to block the domain at perimeter security devices, update URL filtering lists, and monitor for any resurgence of activity from the associated IP address or its surrounding address space. Since the site is offline, investigators should preserve the current forensic artifacts, such as the DNS records, registration details, and VirusTotal scan results, for correlation with future incidents that may reuse the same infrastructure or branding tactics.