thegiftgalaxy[.]shop

This domain, thegiftgalaxy.shop, is a confirmed phishing site targeting the TON (The Open Network) blockchain ecosystem. Registered through Cloudflare, Inc., the domain was detected as malicious by 8 of 95 security vendors on VirusTotal and is blocked by PhishDestroy and ScamSniffer blocklists. The page title, TON AML CHECK, is consistent with social engineering tactics used to trick users into connecting their TON wallets or revealing seed phrases under the pretense of an anti-money laundering compliance check. The domain resolves to IP address 172.67.128.78, hosted in the United States by Cloudflare (AS13335).

No SSL certificate was observed, which is unusual for a site claiming to perform AML checks and may indicate a lack of encryption or a hastily deployed phishing page. The domain uses Cloudflare nameservers (ingrid.ns.cloudflare.com and rodrigo.ns.cloudflare.com). As of the July 24, 2026 report date, the domain has been taken offline.

Defenders should ensure any users who may have visited the site are warned not to share seed phrases or private keys; any wallet interactions with this domain should be treated as compromised. No Safe Browsing or OTX data was available in this report, so additional retrospective analysis may be warranted. The risk level is elevated due to the targeted nature of the TON wallet phishing and the use of a compliance-themed lure, which has proven effective in social engineering attacks.