ton[.]airdrpsalerts[.]xyz

Analysis of ton.airdrpsalerts.xyz indicates a brand‑impersonation campaign targeting Google. The domain was registered through Dynadot LLC on 4 November 2025 and uses Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. DNS resolution points to 142.250.185.68, an address owned by AS15169 Google LLC in the United States, which may be intended to lend credibility. No TLS certificate was observed, and HTTP requests return an offline status, confirming that the site is currently not reachable.

The page title returned “Google”, matching the declared brand target, and the domain is listed on one active security blocklist. Independent scanning on VirusTotal shows that 15 of 95 antivirus or URL‑reputation engines flagged the domain as malicious, and the threat was also blocked by PhishDestroy. Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious assessment. The combination of a newly created domain, Cloudflare front‑end, Google‑owned IP, lack of encryption, and multiple vendor detections suggests a deliberate attempt to deceive users into believing the site is a legitimate Google service.

Uncertainty remains regarding the specific payload or credential‑capture mechanism because the site is offline and no content has been captured. Defenders should continue to block the domain at perimeter defenses, monitor DNS queries for the associated Cloudflare name servers, and add the IP address to outbound allow‑list exclusions only after verification. Automated URL filtering services should retain the existing block, and incident response teams should advise users that any login prompts from this URL are fraudulent. Ongoing intelligence collection is recommended to capture the site’s content should it become active again.