ton[.]airdropsalert[.]us

Analysis of ton.airdropsalert.us indicates a confirmed brand impersonation campaign targeting Google, classified as a crypto scam. The domain, registered on October 18, 2025, through Dynadot LLC, currently resolves to IP 142.251.163.105, hosted under AS15169 (Google LLC) in the United States. Infrastructure review reveals the domain uses Cloudflare nameservers (brenna.ns.cloudflare.com, hassan.ns.cloudflare.com) but lacks an SSL certificate, increasing exposure to interception risks. The page title 'Google' directly aligns with the reported brand target, suggesting an intent to deceive users into believing the site is affiliated with Google.

Detection data shows the domain appears on one security blocklist (PhishDestroy) and is flagged by 12 of 93 security vendors on VirusTotal, confirming malicious classification. Gridinsoft assigns a trust score of 0/100, further corroborating its fraudulent nature. As of July 23, 2026, the domain is offline, though historical records indicate it was actively serving content prior to takedown. The absence of an SSL certificate and reliance on Cloudflare nameservers are consistent with low-effort phishing infrastructure, though the use of Google LLC’s IP range may reflect attempts to evade reputation-based filtering.

Defenders should treat this domain as compromised and block all resolutions at the DNS level. Given the crypto scam classification, monitor for related domains using the 'airdropsalert' subdomain pattern or similar Google-themed lures. No evidence links this domain to a specific phishing kit or additional payloads, so further forensic analysis of captured traffic or historical snapshots would be required to determine exact attack vectors. The domain’s registration age (9 months) suggests it may have been part of a longer-term campaign, warranting retrospective log reviews for prior exposure.