ton[.]airdropsalert[.]app

Analysis of ton.airdropsalert.app indicates that the domain was actively used for a crypto‑related scam that impersonated Google. The domain is registered through Cloudflare, Inc., which obscures registrant details and enables rapid DNS updates. DNS resolution points to IP address 142.250.185.132, an address owned by AS15169 Google LLC and geolocated to the United States. Leveraging infrastructure owned by a legitimate cloud provider is a common tactic to increase trust and evade simple network‑based filters. The site presented the page title “Google,” matching the declared brand target, and was classified as a crypto scam in the intelligence feed.

Security‑vendor scans on VirusTotal recorded 15 detections out of 95 scanners, confirming that a subset of anti‑malware engines identified malicious behavior. The domain appears on a single blocklist, specifically PhishDestroy, and has been flagged by that service. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the elevated risk assessment. No TLS certificate was observed, meaning the site was reachable only via unencrypted HTTP, which further reduces the cost of deployment for attackers. The current operational status is offline, and the page is no longer reachable as of the report date, July 23, 2026.

Defenders should continue to block the domain at perimeter firewalls and DNS filtering solutions, even though the site is offline, to prevent re‑use of the same host name. Monitoring for new subdomains under the airdropsalert.app second‑level domain and for similar Cloudflare‑registered domains that resolve to Google‑owned IP space is recommended. Correlation of logs that contain HTTP requests to the IP 142.250.185.132 with the “Google” page title may help identify residual victim traffic. Incident response teams should treat any credential or wallet information submitted to this site as compromised and advise affected users to revoke credentials and secure their crypto assets.