ton[.]airdropsalert[.]biz

The domain ton.airdropsalert.biz is currently flagged as an elevated‑risk brand‑impersonation site targeting Google. Infrastructure analysis shows the domain resolves to the IP address 142.250.185.196, which belongs to the AS15169 block owned by Google LLC and is geolocated in the United States. The domain was registered on October 18, 2025 through Dynadot LLC and uses Cloudflare nameservers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com). No TLS certificate is presented, indicating the site is served over plain HTTP, and the Gridinsoft trust score is 0 out of 100, reinforcing the low credibility assessment.

The page title returned by the HTTP response is simply "Google", matching the declared brand target. VirusTotal scans report that 15 of 95 security vendors have flagged the domain, and the domain appears on at least one public security blocklist. It has also been listed by PhishDestroy as a blocked entity. The reported scam type is a crypto scam, although the site is offline at the time of analysis, limiting visibility into the exact payload or phishing flow.

Given the combination of brand impersonation, low trust score, multiple vendor detections, and blocklist presence, defenders should treat ton.airdropsalert.biz as malicious. Recommended actions include adding the domain to corporate web‑filter blocklists, monitoring DNS queries for the domain, and ensuring that any traffic to the associated IP address is denied or sandboxed. Continuous re‑evaluation is advised in case the site returns to an online state or new intelligence emerges.