tonkeeperru[.]helpscoutdocs[.]com

This domain, tonkeeperru.helpscoutdocs.com, is assessed as having an elevated risk level due to its specific threat type of brand impersonation. The domain impersonates the cryptocurrency platform Toncoin, potentially misleading users and posing a significant threat to those seeking legitimate information or services.

Analysis indicates that the domain has been flagged by 2 out of 95 security vendors on VirusTotal, suggesting a low but notable level of suspicion. The domain was registered through Amazon Registrar, Inc., and created on August 05, 2013. It resolves to the IP address 3.225.219.144 and uses a Let's Encrypt SSL certificate. The page title, 'Вопросы и ответы про Tonkeeper,' translates to 'FAQs about Tonkeeper,' which is consistent with the impersonation of Toncoin. The domain has a Gridinsoft trust score of 0/100, indicating a complete lack of trustworthiness. Additionally, the domain appears on one security blocklist, further confirming its malicious nature. The technologies detected on the domain include Envoy, HSTS, and HTTP/3, which could be used to enhance the credibility of the impersonation and make it more difficult for users to identify the site as malicious.

To mitigate the risks associated with this brand impersonation, users should verify the authenticity of the domain by checking the official Toncoin website and other trusted sources. Security teams are advised to monitor for any further activity related to this domain and to update their blocklists to include tonkeeperru.helpscoutdocs.com. Organizations should also educate their users on the importance of verifying URLs and looking for official SSL certificates to avoid falling victim to such impersonation attacks.