ewt[.]airdrpsalerts[.]life

Analysis of ewt.airdrpsalerts.life indicates confirmed brand impersonation targeting Google, with infrastructure designed to mimic legitimate Google services. The domain, registered through Cloudflare, Inc., resolves to IP 142.250.185.164 (AS15169, Google LLC, US), a hosting pattern consistent with abused cloud infrastructure. The SSL certificate is issued by Google Trust Services (WE1), further aligning with the impersonation attempt. The page title explicitly displays 'Google,' reinforcing the brand deception. Current HTTP status returns 502 (Bad Gateway), which may indicate temporary hosting issues or evasion tactics.

Detection coverage is limited but notable: 6 of 95 security vendors on VirusTotal flag the domain, and it appears on one security blocklist. Nameservers are reported as NS_NOT_FOUND, suggesting possible misconfiguration or deliberate obfuscation. Technologies detected include Bootstrap, jQuery, Cloudflare Browser Insights, and Cloudflare itself, alongside HTTP/3 support, which may be leveraged to bypass legacy security controls. Defenders should treat this domain as high-risk due to its active status, brand impersonation, and association with Google's infrastructure.

Immediate blocking at the DNS or proxy level is recommended. Further investigation should examine network logs for connections to 142.250.185.164 or related subdomains, as well as SSL certificate fingerprints matching Google Trust Services. The domain's reliance on Cloudflare may complicate takedown efforts, necessitating coordination with the registrar and hosting provider. No evidence currently links this domain to a specific phishing kit or campaign beyond the Google impersonation.