ewt[.]airdropsalert[.]us

On July 23, 2026, analysts observed that the domain ewt.airdropsalert.us was registered on October 18, 2025 through Dynadot LLC. DNS resolution points to the IP address 142.251.111.104, which belongs to ASN 15169 operated by Google LLC and is geographically located in the United States. The domain is delegated to the Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No TLS certificate was presented during connection attempts, indicating the site served only HTTP. Reputation data shows a Gridinsoft trust score of 0 out of 100 and a single inclusion on a security blocklist.

Google Safe Browsing classifies the site as a social‑engineering threat, and the anti‑phishing service PhishDestroy has already blocked it. VirusTotal analysis recorded 12 positive detections out of 93 scanning engines, reinforcing the malicious assessment. The page title returned by the server is “Google”, matching the declared brand target of Google. The observed scam type is a crypto‑related scam, although the exact payload or transaction flow has not been publicly disclosed.

The infrastructure currently reports an offline status, suggesting that the malicious content has been taken down or the hosting has been disrupted. Despite the domain pointing to infrastructure owned by Google, the combination of a brand‑impersonating title, low trust score, multiple vendor detections, and explicit blocklist entries indicates a high‑risk threat. Defenders should add ewt.airdropsalert.us to domain‑blocking rules, monitor traffic to 142.251.111.104 for any residual activity, and consider extending monitoring to the associated Cloudflare name servers. Continued observation of future DNS changes or re‑activation of the site is advisable, as threat actors often resurrect similar domains after takedown.