ewabsturz[.]com

The domain ewabsturz.com is presently active and hosts a web page titled “EWAbsturz GmbH - Ihr Partner für Absturzsicherungen und Abdichtungen”. The site is delivered over HTTPS using a Let’s Encrypt R13 certificate and runs on an Nginx server with jQuery UI and jQuery libraries visible in the page source. It resolves to IP 185.30.32.226, which belongs to AS48324 operated by webgo GmbH in Germany. The authoritative name servers are ns1.webgo.de, ns2.webgo.de, ns3.webgo.de, and ns4.webgo.de. The domain was created on 20 December 2019 and remains under registration with InterNetX GmbH. Multiple threat‑intelligence sources label the site as a generic phishing operation. Gridinsoft assigns a trust score of 0 out of 100, and five of ninety‑five VirusTotal scanners have flagged the domain as malicious. It appears on one public blocklist and is listed in a single AlienVault OTX pulse. PhishDestroy currently blocks the domain, indicating that it has been observed delivering credential‑stealing content. The evidence points to a credential‑collection campaign that impersonates the legitimate EWAbsturz GmbH brand, but the exact phishing kit and victim profile remain unknown. Defenders should treat ewabsturz.com as high‑risk and enforce network‑level blocking of the domain and its resolving IP address. Email gateways should be configured to flag or reject messages containing URLs that resolve to the identified IP range. Continuous DNS monitoring for changes to the name‑server set or new A‑record assignments is recommended, as the infrastructure could be reused for additional malicious sites. User education campaigns should highlight the legitimate EWAbsturz GmbH branding to reduce the success rate of credential‑phishing attempts.