stonfi-swap[.]com

The domain stonfi-swap.com has been identified as a brand impersonation threat targeting CoinGecko, a cryptocurrency data aggregator. Analysis indicates the site masquerades as a decentralized trading platform for the TON blockchain, specifically impersonating the legitimate STON.fi swap service. The threat type is classified as brand impersonation with elevated risk due to its potential to deceive users into disclosing wallet credentials or authorizing fraudulent transactions. As of the latest verification, the domain has been taken offline. Infrastructure analysis reveals the domain was registered on August 30, 2024, through NiceNIC International Group Co., Limited. It resolves to the IP address 185.149.120.107, hosted under AS57724 (DDOS-GUARD LTD) in Russia. Security vendors have flagged the domain, with 14 out of 95 VirusTotal engines detecting malicious activity. The site was listed on two security blocklists, including PhishDestroy and ScamSniffer, and lacked an SSL certificate, further indicating its fraudulent nature. The page title, 'STONfi Swap Buy Sell TON | Ston.fi Swap: Decentralized Trading on TON Blockchain,' closely mimics the branding of the legitimate STON.fi platform, a tactic commonly employed to lend credibility to phishing schemes. The domain is currently offline, though its prior activity underscores the need for vigilance. Users are advised to verify the authenticity of cryptocurrency platforms by cross-referencing official domains and checking for valid SSL certificates. Organizations should monitor for newly registered domains impersonating trusted brands, particularly those leveraging bulletproof hosting providers like DDOS-GUARD. Blocking the IP address 185.149.120.107 and domains registered via NiceNIC with similar patterns may mitigate further exposure. Cryptocurrency wallet users should revoke any suspicious transaction approvals and report the domain to relevant threat intelligence platforms for broader awareness.