ton-station[.]gitbook[.]io

Analysis of the domain ton-station.gitbook.io indicates active brand impersonation targeting Base, a cryptocurrency platform, as of July 25, 2026. The domain, registered through Cloudflare, Inc. on March 30, 2014, resolves to an IPv6 address (2606:4700:4407::6812:282f) hosted on Cloudflare's network (AS13335). Infrastructure analysis reveals the use of Cloudflare nameservers (dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1). The site returns an HTTP 307 status code, suggesting a temporary redirect, though the destination remains unconfirmed. Detection data is limited but indicative of malicious intent.

As of the latest scan, one of 93 security vendors on VirusTotal flags the domain, and it appears on a single security blocklist, specifically PhishDestroy. The page title, 'Ton Station,' does not directly reference Base but aligns with the broader cryptocurrency ecosystem, which may be leveraged to deceive users. Gridinsoft assigns a trust score of 0/100, further supporting the assessment of high risk. The domain's longevity (registered in 2014) is atypical for phishing campaigns, which often use recently registered domains. However, this does not preclude malicious repurposing of an older domain.

No evidence of a phishing kit or additional scam categorization (e.g., crypto drainer, giveaway) is present in the available data. Defenders should treat this domain as an active threat, particularly given its association with a high-value cryptocurrency brand. Network-level blocking of the resolved IP and domain is recommended, alongside monitoring for related infrastructure or redirect chains. Further investigation into the redirect target and user interaction flow is advised to determine the full scope of the campaign.