ton[.]airdrpalerts[.]cfd

The domain ton.airdrpalerts.cfd was registered through Dynadot LLC and first observed on October 25, 2025. It is hosted on Cloudflare nameservers (brenna.ns.cloudflare.com, hassan.ns.cloudflare.com) and resolves to IP address 172.217.18.4, which belongs to AS15169 Google LLC in the United States. No TLS certificate was presented for the host, and an HTTP request returns no content because the site has been taken offline. The page title returned by the server is "Google", matching the declared brand target of Google and confirming a brand‑impersonation motive.

Threat intelligence indicates the domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service. VirusTotal analysis shows that 12 of 95 scanned security vendors flagged the domain, suggesting a notable detection rate. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious classification. The combined evidence—brand‑targeted page title, absence of SSL, low trust score, multiple vendor detections, and blocklist inclusion—supports the assessment that ton.airdrpalerts.cfd was used for a Google brand impersonation campaign.

Defenders should ensure the domain is added to DNS and URL filtering policies, monitor for any re‑registration or resurrection of the same host name, and consider extending watchlists to include other domains registered with Dynadot that use the same Cloudflare nameservers. Because the resolved IP is owned by Google, any legitimate traffic to Google services will share the same address range, so alerts should be correlated with the domain name rather than IP alone to avoid false positives. Continuous telemetry collection from endpoint security solutions is recommended to capture any residual artifacts that may have been delivered before the takedown.