tonlucky[.]net

As of July 23, 2026, the domain tonlucky.net is flagged as a wallet/seed phishing scam. This domain appears on two security blocklists, PhishDestroy and ScamSniffer, indicating a high likelihood of malicious activity. The domain does not have an SSL certificate, which is a common trait of phishing sites as they often lack the security measures of legitimate websites. The domain is registered through NiceNIC International Group Co., Limited, and resolves to the IP address 172.67.188.162, located in the United States and associated with Cloudflare, Inc. (AS13335).

The domain was created on September 04, 2024, and currently has a status of offline, which suggests the operators may have taken it down to avoid detection or because the campaign has concluded. The Gridinsoft trust score for this domain is 0 out of 100, reflecting a complete lack of trustworthiness. Analysis indicates that 15 out of 95 security vendors have flagged this domain, further corroborating the threat. Given the elevated risk level and the specific impersonation of the brand 'ton,' defenders should treat any related content or links with extreme caution.

It is recommended to block this domain and educate users about the risks of wallet/seed phishing to prevent potential data breaches or financial losses. The exact content of the site has not been analyzed, but the page title 'TON Lucky' suggests it may have been designed to trick users into believing it is affiliated with the legitimate 'ton' brand. Defenders should monitor for any resurgence of this domain and related IP addresses, and consider implementing additional security measures such as DNS blacklisting and user awareness training.