ton2mix[.]com

This domain, ton2mix.com, operates as a fraudulent cryptocurrency mixing service impersonating the TON (The Open Network) ecosystem. Analysis indicates it specifically targets Toncoin (TON) users by offering fake anonymity tools, likely functioning as a crypto drainer to siphon funds from victims under the guise of privacy enhancement. The page title, 'TON Mixer – Anonymous Toncoin (TON) Mixing for Maximum Privacy,' directly mimics legitimate TON services to deceive users into transferring assets to attacker-controlled wallets. Technical evidence confirms elevated risk: the domain is flagged by 12 out of 95 security vendors on VirusTotal, appears on two security blocklists (PhishDestroy and OISD), and was registered on July 17, 2025, through NiceNIC International Group Co., Limited. Infrastructure analysis reveals Cloudflare protection (resolving to 172.67.193.85) and a Google Trust Services SSL certificate, which may lend false legitimacy. The domain was also identified in one AlienVault OTX threat intelligence pulse, further corroborating malicious intent. Users who visited ton2mix.com should immediately cease all interactions and revoke any connected wallet permissions. If funds were transferred, report the incident to the relevant blockchain explorer and local cybercrime authorities. Monitor associated wallets for unauthorized transactions and consider migrating assets to a new wallet if exposure is confirmed. Given the domain's current offline status, remain vigilant for similar impersonation attempts targeting TON or other cryptocurrency platforms.