connect-ton[.]vercel[.]app

This domain, connect-ton.vercel.app, poses a high-risk brand impersonation threat targeting users of the TON (The Open Network) blockchain ecosystem. Analysis indicates the site masquerades as an official TON-related application, specifically a "Ton Sample TWA" (Trusted Web Activity), to deceive visitors into interacting with malicious smart contracts or disclosing sensitive credentials. The impersonation tactic is designed to exploit trust in the TON brand, potentially leading to unauthorized asset transfers or account takeovers within crypto wallets. Infrastructure analysis reveals multiple technical indicators supporting this assessment. The domain was registered on February 21, 2026, through Tucows Domains Inc., and is currently hosted on an IP (64.29.17.3) associated with Amazon.com, Inc. (AS16509). Security vendor detections on VirusTotal report 14/95 flags for phishing-related activity, while Google Safe Browsing has explicitly categorized the domain as malicious. Additionally, the domain appears on one security blocklist and is actively blocked by at least one threat intelligence feed. The SSL certificate, issued by Google Trust Services (WR1), does not mitigate the risk, as legitimate-looking encryption is commonly used to lend false credibility to phishing sites. Users who have visited connect-ton.vercel.app should immediately revoke any wallet permissions granted to the site and inspect connected applications for unauthorized access. If credentials or recovery phrases were entered, affected wallets must be migrated to new seed phrases, and all linked accounts should be monitored for suspicious transactions. Devices used to access the domain should undergo a malware scan to detect potential secondary infections. Given the domain remains active, network-level blocking of 64.29.17.3 and related subdomains is recommended for organizations managing TON infrastructure.