mytonwallet[.]click

The domain mytonwallet.click is a confirmed phishing site engaged in brand impersonation targeting Telegram users. It presents itself as 'MyTonWallet: Secure & User-Friendly Crypto Wallet for TON coin', a fraudulent replica of legitimate Telegram-associated cryptocurrency services. The site specifically conducts seed-phishing attacks, attempting to steal cryptocurrency wallet recovery phrases. No drainer kit was identified, and the domain is currently taken offline.

Technical indicators confirm the malicious nature of mytonwallet.click. The domain was flagged by 3 of 95 VirusTotal security vendors, including alphaMountain.ai, Fortinet, and Sophos. It appears on one security blocklist (PhishDestroy) and was registered through Web Commerce Communications Limited on June 11, 2025. The site resolved to the IPv6 address 2606:4700:3035::ac43:ae85, hosted by Cloudflare in the US (AS13335), with no SSL certificate issued. Gridinsoft assigned a trust score of 0/100, and the domain utilized a single nameserver.

Victims of mytonwallet.click should immediately revoke any token approvals associated with the phishing site and transfer funds to a new, secure wallet. If wallet recovery phrases or private keys were entered, consider the original wallet compromised. Report the domain to Telegram’s security team and submit it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group. Monitor financial accounts for unauthorized transactions and enable two-factor authentication on all related services.