ewt[.]airdrpsalert[.]sbs

This report details the threat posed by the domain ewt.airdrpsalert.sbs. The site presented a page title of "Google" and was designed to impersonate the Gmail brand. The threat is impersonation, specifically a phishing attack aimed at deceiving users into believing they are interacting with a legitimate Google or Gmail service, likely to harvest login credentials.

Technical analysis reveals that the domain was flagged by 7 out of 95 VirusTotal vendors. It is registered with Dynadot LLC and was created on October 22, 2025. The site resolves to IP address 142.250.80.36, located in the United States and belonging to AS15169 Google LLC. Notably, the site does not have SSL encryption. The domain is currently offline and down.

The overall risk level for this domain is high, as indicated by a DOM risk score of 10 and a GridinSoft trust rating of 0 out of 100. It has been flagged by security entities including ChainPatrol, Certego, CRDF, G-Data, and Gridinsoft, and appears on 2 blocklists. The combination of a low trust score, high risk rating, and multiple detections confirms the malicious intent of this impersonation site.