ewt[.]airdrpsalert[.]cfd

Analysis of the domain ewt.airdrpsalert.cfd indicates a brand impersonation campaign targeting Google, classified as elevated risk. The domain was registered on October 22, 2025, through Dynadot LLC and has since been taken offline. Infrastructure analysis reveals the domain resolved to IP address 172.253.63.106, geolocated within AS15169 (Google LLC), though this does not confirm legitimate affiliation. Nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com suggest Cloudflare hosting, a common tactic to obscure origin and evade detection. No SSL certificate was present, increasing exposure to interception risks.

The page title 'Google' directly aligns with the reported scam type of brand impersonation. Detection data shows 11 of 95 security vendors on VirusTotal flagged the domain as malicious, while it also appears on one security blocklist (PhishDestroy). Trust scores from Gridinsoft and Scamadviser both rate the domain at 0/100 and 1/100, respectively, reinforcing its suspicious status. The domain's current offline status may indicate takedown or temporary suspension, though historical activity remains a concern.

Defenders should treat this domain as confirmed malicious infrastructure. Blocklist integration, DNS filtering, and monitoring for related subdomains or IP reuse are recommended. Given the absence of an SSL certificate and the use of Cloudflare nameservers, network-level detection rules targeting these indicators may help identify similar threats. The exact content or functionality of the site remains unanalyzed, but the combination of brand impersonation, low trust scores, and vendor detections provides sufficient evidence for proactive mitigation.