ton-mixer[.]to

Analysis of ton-mixer.to, a domain registered through the Government of the Kingdom of Tonga on February 22, 2024, indicates a clear brand impersonation campaign targeting the TON cryptocurrency ecosystem. The site’s page title, "TON mixer | Toncoin mixer - Top Cryptocurrency tumbler for anonymous TON transactions," directly references the TON brand and suggests a fraudulent service offering transaction mixing. Technical indicators reinforce the malicious profile: the domain resolves to IP address 45.12.2.86, an address located in Ukraine and associated with AS6698 Virtual Systems LLC, a hosting provider often linked to malicious activity. No SSL certificate is present, exposing any connections to the site to interception and confirming a lack of legitimate security controls.

Detection services on VirusTotal have flagged the domain in 16 of 95 vendor scans, demonstrating consensus among security products that the site is malicious. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on two external blocklists, further corroborating its reputation as a threat. The domain’s nameservers, ns1.zomro.net and ns2.zomro.ru, are typical of low‑cost hosting services used by threat actors. Current monitoring shows the site has been taken offline, yet historical activity and the presence on blocklists mean that remnants of the campaign may persist in cached content or through related infrastructure.

Defenders should add ton-mixer.to to network deny lists, monitor for DNS queries to its associated nameservers, and watch for traffic to its hosting IP range. Additional precaution includes flagging any communications that reference TON mixing services as potentially fraudulent, especially those that reference the domain or similar branding.