tonstaker[.]net

The domain tonstaker.net was registered on July 10, 2025 through NameSilo, LLC. Authoritative name servers are ns5.hawkhost.com and ns6.hawkhost.com, indicating the site was hosted on the HawkHost platform. DNS resolution points to IP address 172.96.187.57, which is announced by AS32475 Internap Holding LLC and is geolocated in the United States. No TLS certificate was detected, meaning the service was delivered over plain HTTP. The sole visible page title, “TonStake | 2x TON & Toncoin Staking Platform,” reveals a cryptocurrency staking narrative and aligns with the classification of a crypto‑scam.

The domain is explicitly marked as impersonating the brand “base,” suggesting that attackers may have leveraged the base brand’s reputation to lure victims. VirusTotal logged a single positive detection out of 95 scanners, and the domain appears on one public blocklist. Gridinsoft assigns a trust score of 0 / 100, reflecting a highly suspicious reputation. PhishDestroy has taken the site offline, and the current status is reported as offline.

While these indicators confirm malicious intent, the internal content of the site beyond the title has not been captured, leaving the exact phishing or credential‑harvesting mechanisms uncertain. Defenders should add tonstaker.net and its IP address to URL filtering and firewall block lists, monitor the associated nameservers for newly registered domains, and incorporate the domain into internal threat intelligence feeds. Continued observation of the registrar and hosting provider may reveal reuse of the infrastructure in future campaigns, and alerts should be generated if similar branding or page‑title patterns reappear.