eth-cowswap[.]click

The domain eth-cowswap.click was registered on June 11, 2026 through Dynadot, LLC and is currently active with an elevated risk rating. DNS resolution points to the single IPv4 address 130.12.180.128, and the domain is served by the authoritative name servers ns1.dyna-ns.net and ns2.dyna-ns.net. Threat intelligence platforms have flagged the domain as malicious: PhishDestroy, MetaMask, and SEAL have each added it to their blocklists, and it appears on three additional security blocklists. VirusTotal scans show that eight of ninety‑one antivirus and URL scanners have flagged the domain, indicating a modest but non‑trivial detection rate.

The domain’s short lifespan—less than two months—combined with its inclusion on multiple blocklists suggests a purposeful, targeted campaign rather than an accidental misconfiguration. While the specific brand or service being spoofed has not been disclosed in the available data, the classification as generic phishing implies that the site is likely attempting to harvest credentials or other sensitive information. Uncertainty remains around the exact payload, the presence of SSL/TLS certificates, and any associated command‑and‑control infrastructure, as these details have not been publicly released.

Defenders should prioritize adding the IP address 130.12.180.128 to network‑level deny lists, enforce DNS filtering that blocks eth-cowswap.click, and monitor outbound traffic for connections to the identified host. Endpoint protection suites should be updated to incorporate the eight VirusTotal detections, and any user‑facing applications that interact with web content—especially cryptocurrency wallets—should be configured to reject URLs resolved to this domain. Continuous re‑evaluation is recommended to capture any changes in hosting, additional blocklist entries, or new detection signatures.