ton[.]airdrpsalert[.]bond

This domain, ton.airdrpsalert.bond, is flagged for brand impersonation targeting Google. Analysis indicates the site presents a fraudulent login interface under the page title 'Google,' designed to harvest credentials from unsuspecting users. No crypto drainer or wallet-stealing scripts were observed in initial scans, but the domain aligns with credential phishing campaigns commonly used for account takeovers or lateral movement in compromised environments.

Technical indicators confirm elevated risk: VirusTotal reports 3/95 security vendors flagging the domain as malicious. The domain was registered through Dynadot LLC on October 26, 2025, and resolves to the IPv6 address 2a00:1450:4001:811::2004, which is associated with legitimate infrastructure but frequently abused for transient phishing operations. Gridinsoft assigns a trust score of 0/100, and the domain appears on one security blocklist, specifically PhishDestroy. Google Safe Browsing (GSB) status is not explicitly listed, but the low detection count on VirusTotal suggests the campaign may still be in early deployment or evading detection through rapid rotation.

As of the latest verification, ton.airdrpsalert.bond has been taken offline, likely due to registrar enforcement or hosting provider intervention. However, residual risk remains due to the domain's recent creation and the potential for re-activation under altered infrastructure. Organizations should add the domain to blocklists, monitor for related subdomains or typosquatting variants, and alert users to the impersonation of Google services. Network defenders are advised to inspect logs for connections to the IPv6 address and review authentication attempts from users who may have interacted with the phishing page prior to takedown.