ton[.]airsdropsalert[.]lol

The domain ton.airsdropsalert.lol is flagged as a brand impersonation campaign targeting Google. Infrastructure analysis shows the domain was registered on November 5, 2025 through Dynadot LLC and resolves to IP address 142.250.74.196, which belongs to AS15169 Google LLC and is geolocated in the United States. The domain uses Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, but no SSL certificate is presented, leaving the site unencrypted. A Gridinsoft trust score of 0 out of 100 indicates a highly untrusted reputation.

The page title returned by the server is "Google," matching the declared brand target, yet no further page content has been captured because the site is currently taken offline. VirusTotal scans report that six of ninety‑five security vendors flagged the domain, reinforcing the suspicion of malicious intent. The domain appears on one external security blocklist and is actively blocked by PhishDestroy, confirming that at least one anti‑phishing service has identified it as abusive. Despite the IP belonging to Google’s network, the lack of a valid TLS certificate and the low trust score suggest the host is being abused rather than a legitimate Google service.

Evidence gaps remain regarding the exact payload or credential‑harvesting mechanisms, as no HTTP response body or login form details have been observed. Defenders should continue to block the domain at network perimeter, monitor DNS queries for the domain and its associated nameservers, and ensure endpoint protection solutions are updated to reflect the six VirusTotal detections. Further investigation of any traffic directed to the IP address may reveal additional malicious activity, and threat‑intel sharing with partners is recommended to improve collective detection of this impersonation vector.