ton[.]airsdropsalerts[.]click

The domain ton.airsdropsalerts.click was observed as an offline site that leveraged a brand‑impersonation technique targeting Google users. Registration data shows the domain was created on 07 November 2025 through Dynadot LLC, and DNS resolution points to the IP address 142.250.185.132, which belongs to AS15169 Google LLC and is geolocated in the United States. No TLS certificate was presented for the host, indicating that HTTPS was not configured at the time of analysis. The authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, both operated by Cloudflare.

Threat intelligence feeds have flagged the domain as a brand‑impersonation case. VirusTotal analysis recorded detections by nine of the ninety‑five scanning engines that evaluated the host. The site appears on a single security blocklist and has been actively blocked by the PhishDestroy mitigation service. The page title returned by the HTTP response is "Google," matching the claimed brand target, and the domain is explicitly listed as impersonating Google.

Current evidence suggests the infrastructure was deliberately pointed at a legitimate Google IP range, likely to increase trust and evade simple IP‑based blocking. The lack of an SSL certificate, combined with the offline status, may indicate a temporary testing phase or a takedown after detection. Defenders should continue to block the domain at the DNS and URL filtering layers, monitor for any re‑registration attempts, and consider adding the associated IP address to network‑level deny lists pending further verification. Ongoing surveillance of the Cloudflare name servers for new sub‑domains that reference similar branding patterns is advised, as threat actors often reuse these hosting configurations.