ewt[.]airdrpsalert[.]lat

Analysis indicates that the domain ewt.airdrpsalert.lat was registered on 26 Oct 2025 through Dynadot LLC. The authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, pointing to a Cloudflare‑managed DNS layer. DNS resolution returns the IPv4 address 172.253.63.105, which belongs to AS15169 owned by Google LLC and is geolocated in the United States. No TLS certificate is presented, confirming an HTTP‑only service. The sole HTTP response observed contains the page title “Google”, matching the declared brand target. The domain is classified as a brand‑impersonation campaign against Google.

The site has been taken offline at the time of reporting, but historical activity placed it on two independent blocklists, PhishDestroy and ScamSniffer, and it appears on two additional security blocklists referenced by external scanners. VirusTotal scans show that five of ninety‑five AV engines flagged the domain, and Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious assessment. Evidence gaps remain: the content of the landing page beyond the title has not been captured, and no active SSL/TLS certificate prevents analysis of potential credential‑harvesting forms. Because the IP address is owned by Google, the malicious host may have leveraged a compromised or misconfigured Google‑owned server, or the attacker may have used a cloud‑based hosting service to mask their true infrastructure.

No indication of additional infrastructure such as CDN‑fronting, bullet‑proof hosting, or known phishing kits is present. Defenders should block the domain at the DNS and proxy layers, continue monitoring the associated IP for any re‑activation, and add the domain to internal allow‑list exclusions. Security teams should also review any recent authentication events for Google services that originate from the IP address range 172.253.63.0/24, as compromised credentials could have been harvested before takedown.