# Phishing sites impersonating Ton

PhishDestroy has recorded 115 phishing domains impersonating Ton since 2025-08-06, 6 of them in the last 30 days. The most used registrars are NiceNIC and Cloudflare; the most common TLDs are .com and .io. The official Ton domain is ton.org: any other site asking for your login or wallet is not Ton.

115Domains, all time

6Last 30 days

50Online at last check

26Confirmed takedowns

## New domains in the last 90 days

Ton phishing domains detected per day: 19 from 2026-07-25 to 2026-10-22; peak 2.

## How to tell a fake Ton site

Official domain: ton.org.

Words most often added to the brand in reported domains: mixer, duplicate, disabled, usdt, aml, staking, minefreee, tonlucky, gamacasino, coinmarketcape.
- Type the address yourself or use a bookmark; phishing links for Ton arrive through ads, search results, direct messages and fake support accounts.
- Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters.
- Ton does not ask you to confirm your password or card details through a link in an email or SMS.

Paste a suspicious address into the [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker) or check it against the [DestroyList](https://phishdestroy.io/developer-tools/destroylist-check).

## Latest Ton phishing domains

The 50 most recently detected domains impersonating Ton
Domain | First detected | Status at last check | Registrar | 
[bmsmenashop.shop](https://phishdestroy.io/domain/bmsmenashop.shop/) | 2026-10-18 | Online | Dynadot | 
[snapchat-plus.com](https://phishdestroy.io/domain/snapchat-plus.com/) | 2026-10-16 | Online | OVH | 
[bigredstore.shop](https://phishdestroy.io/domain/bigredstore.shop/) | 2026-10-16 | Online | Dynadot | 
[trust-suppport.com](https://phishdestroy.io/domain/trust-suppport.com/) | 2026-10-13 | Offline | TUCOWS.COM | 
[bauhaus2yourhousedesign.shop](https://phishdestroy.io/domain/bauhaus2yourhousedesign.shop/) | 2026-10-11 | Online | Dynadot | 
[kreischerdesign.com](https://phishdestroy.io/domain/kreischerdesign.com/) | 2026-10-10 | Online | Cloudflare | 
[turbocoins.org](https://phishdestroy.io/domain/turbocoins.org/) | 2026-09-21 | Online | NICENIC | 
[trustwallet-helpmgmt.com](https://phishdestroy.io/domain/trustwallet-helpmgmt.com/) | 2026-09-12 | Offline | Cosmotown | 
[surefx.live](https://phishdestroy.io/domain/surefx.live/) | 2026-09-12 | Online | Sav.com | 
[tonmine.pro](https://phishdestroy.io/domain/tonmine.pro/) | 2026-09-05 | Online | Trustname.com | 
[domewex.com](https://phishdestroy.io/domain/domewex.com/) | 2026-09-05 | Online | Trustname.com | 
[carrefourtemis.ca](https://phishdestroy.io/domain/carrefourtemis.ca/) | 2026-08-31 | Online | CENTRALNIC CANADA | 
[101film.live](https://phishdestroy.io/domain/101film.live/) | 2026-08-28 | Online | Dynadot | 
[polymarket-predict.gr.com](https://phishdestroy.io/domain/polymarket-predict.gr.com/) | 2026-08-22 | Online | Key-Systems | 
[rainbet-casinos.de](https://phishdestroy.io/domain/rainbet-casinos.de/) | 2026-08-18 | Online | — | 
[ekmm.0537blog.com](https://phishdestroy.io/domain/ekmm.0537blog.com/) | 2026-08-05 | Online | GoDaddy.com | 
[yonewex.com](https://phishdestroy.io/domain/yonewex.com/) | 2026-07-30 | Online | Trustname.com | 
[chemsoll.com](https://phishdestroy.io/domain/chemsoll.com/) | 2026-07-29 | Online | Turkticaret.net Yazılım Hizmetleri Sanay | 
[bcinvestors.live](https://phishdestroy.io/domain/bcinvestors.live/) | 2026-07-27 | Online | Dynadot | 
[ton.app-beefy.lol](https://phishdestroy.io/domain/ton.app-beefy.lol/) | 2026-06-15 | Online | Dynadot | 
[admin.cyusd.org](https://phishdestroy.io/domain/admin.cyusd.org/) | 2026-06-15 | Online | July Name | 
[yeahchain.com](https://phishdestroy.io/domain/yeahchain.com/) | 2026-06-15 | Online | Gname.com | 
[safetontransact.pages.dev](https://phishdestroy.io/domain/safetontransact.pages.dev/) | 2026-04-29 | Online | Cloudflare | 
[fi-communication.com](https://phishdestroy.io/domain/fi-communication.com/) | 2026-04-25 | Online | Name.com | 
[pidort.pages.dev](https://phishdestroy.io/domain/pidort.pages.dev/) | 2026-04-19 | Online | Cloudflare | 
[fortune-spindriftlab.click](https://phishdestroy.io/domain/fortune-spindriftlab.click/) | 2026-04-15 | Online | Dynadot | 
[usdtflow.ru](https://phishdestroy.io/domain/usdtflow.ru/) | 2026-04-07 | Online | REGRU-RU | 
[bemotex.com](https://phishdestroy.io/domain/bemotex.com/) | 2026-04-05 | Offline | MAT BAO | 
[notcointon.pages.dev](https://phishdestroy.io/domain/notcointon.pages.dev/) | 2026-03-31 | Online | Cloudflare | 
[flashtoken.pages.dev](https://phishdestroy.io/domain/flashtoken.pages.dev/) | 2026-03-28 | Online | Cloudflare | 
[redoclaim.pages.dev](https://phishdestroy.io/domain/redoclaim.pages.dev/) | 2026-03-25 | Online | Cloudflare | 
[qhuehfwihcwefdjsf.pages.dev](https://phishdestroy.io/domain/qhuehfwihcwefdjsf.pages.dev/) | 2026-03-25 | Online | Cloudflare | 
[myzdy.com](https://phishdestroy.io/domain/myzdy.com/) | 2026-03-17 | Online | Gname.com | 
[veivax.com](https://phishdestroy.io/domain/veivax.com/) | 2026-03-04 | Unknown | NiceNIC | 
[bitlydo.com](https://phishdestroy.io/domain/bitlydo.com/) | 2026-03-04 | Offline | Onamae.com | 
[soadax.com](https://phishdestroy.io/domain/soadax.com/) | 2026-03-02 | Unknown | NiceNIC | 
[new-glenn.live](https://phishdestroy.io/domain/new-glenn.live/) | 2026-02-28 | Taken down | NiceNIC | 
[tonkeeperpro.com](https://phishdestroy.io/domain/tonkeeperpro.com/) | 2026-02-26 | Offline | — | 
[connect-ton.vercel.app](https://phishdestroy.io/domain/connect-ton.vercel.app/) | 2026-02-26 | Online | Tucows Domains | 
[bitfiz.net](https://phishdestroy.io/domain/bitfiz.net/) | 2026-02-26 | Offline | Porkbun | 
[clansebit.com](https://phishdestroy.io/domain/clansebit.com/) | 2026-02-26 | Offline | Web Commerce Communications dba WebNic.c | 
[cryptoslx.com](https://phishdestroy.io/domain/cryptoslx.com/) | 2026-02-26 | Offline | Gname.com | 
[runadex.com](https://phishdestroy.io/domain/runadex.com/) | 2026-02-26 | Offline | Web Commerce Communications dba WebNic.c | 
[valkebit.com](https://phishdestroy.io/domain/valkebit.com/) | 2026-02-26 | Offline | Web Commerce Communications | 
[potionalpha.com](https://phishdestroy.io/domain/potionalpha.com/) | 2026-02-26 | Taken down | GoDaddy.com | 
[cryptodude.org](https://phishdestroy.io/domain/cryptodude.org/) | 2026-02-26 | Taken down | Gname.com | 
[ton-aml.net](https://phishdestroy.io/domain/ton-aml.net/) | 2026-02-26 | Offline | PublicDomainRegistry.com | 
[app-app-mytonwallet.gitbook.io](https://phishdestroy.io/domain/app-app-mytonwallet.gitbook.io/) | 2026-02-26 | Online | Cloudflare | 
[viralhigh.com](https://phishdestroy.io/domain/viralhigh.com/) | 2026-02-26 | Online | Onamae.com | 
[koavax.com](https://phishdestroy.io/domain/koavax.com/) | 2026-02-26 | Offline | — | 

[All 115 Ton reports](https://phishdestroy.io/domain/?brand=Ton)

## Where they are registered and hosted

### Registrars

- [NiceNIC](https://phishdestroy.io/registrar/nicenic/)13
- Cloudflare13
- [Gname.com](https://phishdestroy.io/registrar/name-com/)6
- [Hello Internet](https://phishdestroy.io/registrar/hello-internet/)5
- [NameSilo](https://phishdestroy.io/registrar/namesilo/)5
- [Web Commerce Communications](https://phishdestroy.io/registrar/webnic/)5
- [NameCheap](https://phishdestroy.io/registrar/namecheap/)4
- [Dynadot](https://phishdestroy.io/registrar/dynadot/)4

### Top-level domains

- [.com](https://phishdestroy.io/tld/com/)59
- [.io](https://phishdestroy.io/tld/io/)6
- [.live](https://phishdestroy.io/tld/live/)6
- [.dev](https://phishdestroy.io/tld/dev/)6
- [.shop](https://phishdestroy.io/tld/shop/)4
- [.net](https://phishdestroy.io/tld/net/)3
- [.biz](https://phishdestroy.io/tld/biz/)3
- [.org](https://phishdestroy.io/tld/org/)3

### Hosting networks

- CLOUDFLARENET, US38
- Cloudflare, Inc.20
- CLOUDFLARENET - Cloudflare, Inc., US18
- AMAZON-02, US8
- N963-AS-AP N963 PTE. LTD., SG3
- AS-HOSTINGER Hostinger International Limited, CY3
- AMAZON-02 - Amazon.com, Inc., US2
- AS13335 Cloudflare, Inc.2

## Related

- [Typosquatting](https://phishdestroy.io/glossary/typosquatting/)
- [Homoglyph](https://phishdestroy.io/glossary/homoglyph/)
- [Phishing kit](https://phishdestroy.io/glossary/phishing-kit/)
- [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker)
- [Abuse Report Generator](https://phishdestroy.io/developer-tools/abuse-report-generator)
- [If you already used a fake site: emergency guide](https://phishdestroy.io/critical-action)
- [All impersonated brands](https://phishdestroy.io/brand/)

Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is Ton; share of all PhishDestroy reports: 0.05%.

Canonical: https://phishdestroy.io/brand/ton/