toncoin-ton-mixer[.]com

This domain, toncoin-ton-mixer.com, was registered on August 6 2025 through NiceNIC International Group Co., Limited and hosts a page whose title claims to be a Toncoin mixer offering private, secure and anonymous TON transactions. The site resolves to the IPv6 address 2606:4700:3037::6815:245a, which belongs to Cloudflare’s network (AS13335) and is geolocated in the United States. Both authoritative nameservers, milan.ns.cloudflare.com and samara.ns.cloudflare.com, are owned by Cloudflare, indicating the infrastructure is fully outsourced to that provider. No TLS certificate was observed, so the site operated without HTTPS encryption. Detection signals show that 14 of 95 VirusTotal scanners flagged the domain, and the PhishDestroy blocklist actively blocked it.

AlienVault OTX referenced the domain in a single threat‑intelligence pulse, and it appears on one additional security blocklist. Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the malicious assessment. The domain is classified as a crypto‑related scam and specifically impersonates the Toncoin brand, aligning with the known brand‑target field. As of the report date, the site is offline, but the historical artifacts remain relevant for incident response.

Defenders should continue to block any outbound connections to the IPv6 address and add the fully qualified domain name to DNS‑based deny lists. Monitoring for future redeployment of the same registrar or Cloudflare name‑server pair is advised, as threat actors often reuse such infrastructure. Because the page content has not been captured beyond the title, analysts should treat any unobserved functionality as potentially malicious until verified. The combination of registrar choice, Cloudflare hosting, multiple vendor detections, and a zero trust score suggests a high confidence that toncoin‑ton‑mixer.com was used for brand‑impersonation and cryptocurrency fraud.