ton-mixer[.]com

PhishDestroy identifies ton-mixer.com as a confirmed brand impersonation domain, specifically designed to mimic the legitimate Ton cryptocurrency platform. This threat type involves deceiving users into believing they are interacting with an official Ton service, typically to steal login credentials, private keys, or trick victims into sending cryptocurrency to wallets controlled by attackers. The domain's sole purpose is to exploit the trust associated with the Ton brand for financial gain.

Evidence gathered from multiple sources confirms the malicious nature of this domain. VirusTotal reports that 3 out of 95 security vendors flag the domain as malicious, indicating a consensus among cybersecurity tools. The domain was registered on May 01, 2024, through NiceNIC International Group Co., Limited, a registrar often associated with high-risk domains. It resolves to IP address 188.114.97.3 and lacks an SSL certificate, further undermining any pretense of legitimacy. Additionally, the domain appears on 1 security blocklist and was referenced in 1 threat intelligence pulse on AlienVault OTX, correlating it with known malicious activity. The page title "ton-mixer.com | 523: Origin is unreachable" suggests the site is currently offline, likely taken down after being reported.

Users who visited ton-mixer.com should immediately check their accounts for unauthorized transactions and change any passwords or private keys that may have been entered on the site. Running a full security scan with updated antivirus software is recommended to detect potential malware. If any cryptocurrency transfers were made to addresses associated with this domain, users should report the incident to their wallet provider and relevant authorities. PhishDestroy advises all users to always verify domain authenticity by double-checking URLs and only accessing official websites through trusted bookmarks or official app stores.