ewt[.]airdropalerts[.]pro

Analysis of ewt.airdropalerts.pro, created on November 27 2025, shows a domain that was used to impersonate Google in a crypto‑related scam. The site resolves to IP 142.250.185.196, an address owned by AS15169 Google LLC and located in the United States. No SSL certificate was presented, and the HTTP service is currently offline. The page title returned by the server is simply "Google," matching the declared brand target.

Reputation checks indicate a Gridinsoft trust score of 0 out of 100, and the domain appears on a single security blocklist. It has been blocked by PhishDestroy and was flagged by 13 of 93 VirusTotal scanners, confirming that multiple security vendors consider it malicious. The primary threat vector is brand impersonation combined with a cryptocurrency scam, as identified in the intelligence feed.

Defenders should continue to block the domain at perimeter defenses, monitor for any resurgence of the host, and ensure that users are warned against unsolicited communications that reference Google or promise crypto rewards. Because the site is offline, further content analysis is not possible, and the exact delivery mechanism (phishing email, malicious link, etc.) remains unknown. Ongoing vigilance is advised, especially for any new domains that reuse the "airdropalerts.pro" sub‑domain pattern or mimic the same page title.