ton[.]beefyapps[.]sbs

Analysis indicates that the domain ton.beefyapps.sbs was registered on October 24 2025 through Dynadot LLC. The authoritative nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com resolve the domain to the Cloudflare edge address 104.21.55.81, which is owned by AS13335 Cloudflare, Inc. and geolocated to the United States. No TLS certificate is presented; attempts to access the site return an “Access denied” page title that explicitly mentions Cloudflare restricting access. The site has been classified as a brand‑impersonation campaign targeting the cryptocurrency network TON, and it appears on at least one public blocklist, including PhishDestroy.

VirusTotal scans show that 7 of 95 anti‑malware engines flagged the domain, reflecting a moderate level of detection across the security community. Independent reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, indicating extreme lack of confidence. The domain is currently offline, and no further content has been observed.

Given the combination of a recent registration, use of Cloudflare infrastructure without HTTPS, a brand‑impersonation claim, multiple vendor detections, and inclusion on blocklists, the domain should be treated as malicious. Defenders are advised to block any network traffic to ton.beefyapps.sbs, add the domain to internal deny lists, and monitor for any related C2 or phishing infrastructure that may reuse the same IP range or nameserver pattern. Continued observation of VirusTotal and other threat‑intel feeds is recommended to capture any re‑activation or new indicators associated with this infrastructure.