ton[.]app-airdropalert[.]lat

This domain is flagged as an elevated-risk phishing threat targeting Google brand impersonation. Analysis indicates the domain was designed to deceive users into believing it is an official Google service, likely for credential harvesting or malware distribution. The specific threat type involves brand spoofing, where the page title "Google" is used to mimic legitimate Google properties and exploit user trust. Infrastructure analysis reveals the domain ton.app-airdropalert.lat was registered through Dynadot LLC on November 10, 2025, and resolves to the IP address 142.251.140.164, which is geolocated to the United States under AS15169 (Google LLC). Despite resolving to a Google-owned IP, the domain lacks an SSL certificate, a critical red flag for phishing activity. VirusTotal detection shows 13 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and is currently offline, though prior activity remains a concern. No legitimate association with Google or its services has been identified. Mitigation steps for this threat type include immediate blocking of the domain across all network security controls, including firewalls, email gateways, and endpoint protection systems. Organizations should review logs for any prior connections to 142.251.140.164 or the domain itself, particularly from November 10, 2025, onward. User awareness training should emphasize the risks of brand impersonation, focusing on verifying domain authenticity and SSL certificates before entering credentials. Security teams are advised to monitor for similar domains registered through Dynadot LLC or resolving to Google-owned IPs, as these may indicate coordinated phishing campaigns.