ton[.]airdropalerts[.]pro

This domain, ton.airdropalerts.pro, is assessed as an elevated-risk crypto scam impersonating Google, currently offline as of July 25, 2026. Infrastructure analysis reveals the domain was registered on November 27, 2025, through Dynadot LLC and is hosted on Cloudflare nameservers (alexa.ns.cloudflare.com, randall.ns.cloudflare.com). It previously resolved to IP 142.250.186.164, which is assigned to AS15169 (Google LLC) in the US, though this does not confirm hosting by Google. No SSL certificate was detected, increasing susceptibility to interception or tampering. The page title was recorded as 'Google,' aligning with the identified brand impersonation target.

Detection data indicates the domain appears on one security blocklist (PhishDestroy) and was flagged by 6 of 93 security vendors on VirusTotal, though the specific detection categories (e.g., phishing, malware, or scam) are not detailed. Gridinsoft assigns a trust score of 0/100, reinforcing its high-risk classification. The domain's offline status suggests it may have been taken down or abandoned, but defenders should not assume permanent inactivity. No evidence links this domain to a known phishing kit or campaign infrastructure, and the exact content or lure mechanism remains unconfirmed. Defenders should treat this domain as a confirmed Google-branded crypto scam, particularly given its alignment with the 'Google' page title and the crypto scam classification.

Blocklist inclusion and vendor detections provide actionable indicators for network-level blocking or monitoring. The absence of SSL and use of Cloudflare nameservers are common traits in scam infrastructure, though not inherently malicious. Given the domain's age (less than a year old at takedown) and its impersonation of a high-value brand, it may reappear under similar or altered infrastructure. Security teams should monitor for DNS changes, re-registration, or related domains using the same registrar or nameserver patterns.