ton[.]airdrpsalert[.]sbs

Analysis indicates that the domain ton.airdrpsalert.sbs was created on 22 October 2025 and is currently taken offline. The domain is registered through Dynadot LLC and resolves to the IP address 172.253.63.103, which belongs to AS15169 owned by Google LLC and is geolocated in the United States. The hosting infrastructure therefore appears to be on Google’s network, a pattern occasionally observed in credential‑harvesting campaigns that leverage legitimate cloud providers to improve reachability. The domain’s authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating that Cloudflare DNS services are being used for resolution. The site presented a page title of “Google” and is classified as a brand‑impersonation campaign targeting Google.

No TLS certificate was observed, meaning the site was served over plain HTTP. VirusTotal reports three of ninety‑five scanning engines flagging the domain as malicious, and the domain appears on a single security blocklist. PhishDestroy has also listed the domain as blocked. Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the malicious assessment. The overall risk level is elevated, consistent with the observed indicators.

Because the domain is offline, active probing is limited, but defenders should continue to monitor the IP address and associated Cloudflare nameservers for any re‑use. Blocking the domain at the DNS or proxy level is advisable, and security tools that ingest blocklist feeds should retain the existing entry. Incident response teams should treat any email or URL referencing ton.airdrpsalert.sbs as potentially malicious, especially if it purports to request Google credentials. Further investigation could include requesting full payloads from the original phishing emails, if available, to confirm the exact phishing kit used.