app-app-mytonwallet[.]gitbook[.]io

This domain, app-app-mytonwallet.gitbook.io, is actively impersonating MyTonWallet, a cryptocurrency wallet service associated with the TON blockchain. Registered on February 21, 2026, the domain resolves to 104.18.40.47, an IP address hosted on AS13335 (Cloudflare, Inc.) in the United States. Infrastructure analysis reveals the use of Cloudflare services, including HTTP/3 and a Google Trust Services SSL certificate (WE1). The domain returns an HTTP 307 status, which may indicate a temporary redirect or intermediate proxy behavior, though the exact destination remains unconfirmed. Security vendors have flagged this domain, with 8 of 95 engines on VirusTotal detecting it as malicious. It appears on at least one security blocklist (PhishDestroy). The page title, 'MyTonWallet | ton wallet,' directly matches the branding of the legitimate service, reinforcing the likelihood of brand impersonation. No additional details about the site's content or functionality are available, as the page has not been fully analyzed. Defenders should treat this domain as high-risk infrastructure. Block access at the network level and monitor for connections to 104.18.40.47 or related subdomains under gitbook.io. Given the use of Cloudflare, traditional IP-based blocking may have limited effectiveness, so domain-based controls are recommended. Verify any user-reported interactions with this domain, particularly those involving cryptocurrency transactions or credential submission, as these are likely the intended attack vectors.