Verdict
ton-telegram.network shows high-risk / scam indicators.
This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.
| What this site appears to be | An unofficial informational site describing The Open Network (TON) and Toncoin: features, components (Storage, Proxy, DNS, Payments), and links to exchanges and community channels. Contains promotional referral-style links but does not itself appear to solicit deposits or host custody services. |
|---|
Evidence status and limitations
Evidence completeness: UNKNOWN
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 15 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0 reportsAbuseIPDB; shared hosting inflates this count | Noted |
| Domain age | 7.5 years oldRegistered history | Clear |
| Web archive | Archived since 2021Public history exists | Clear |
| Certificate | Encrypted connectionIssued by YR1 | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- Domain age: 3 to 10 years (registration continuity).
- Public web-archive history exists since 2021.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
Full analysis
Security Alert
Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
The website is an unofficial informational reference about The Open Network (TON) and Toncoin, presenting descriptions of the ecosystem, its components, and routes to exchanges and community channels rather than operating an evident custody or deposit service.
Scam/Impersonation Risk
The site presents TON and Toncoin material under the domain name “ton-telegram.network,” including references to Telegram’s historical involvement, TON Wallet, TON Payments, TON Storage, TON Proxy, TON DNS, and a “GET TON NOW” call to action that activates a Telegram bot. It also promotes links to third-party exchanges and community channels. Although no login form, deposit request, wallet connection, or custody function was observed, independent security assessments recorded malicious detections and a confirmed blacklist hit. The site’s apparent informational character therefore does not neutralize the external threat evidence. No conflicting legal identities, confirmed phishing form, or confirmed brand impersonation was established in the supplied page findings.
- The homepage describes TON, Toncoin, Telegram-related history, TON Wallet, TON Payments, TON Storage, TON Proxy, and TON DNS, and includes a promotional “GET TON NOW” action.
- Independent reputation checks recorded 15 malicious detections and 2 suspicious detections, including a confirmed blacklist hit.
- Browser testing recorded 23 external XHR requests and 19 external POST requests across 2 successful runs; no hidden forms, password forms, wallet-provider detection, wallet-connect run, or wallet-drainer run was observed.
Regulatory Verification Notes
The available material describes the site as unofficial and does not present a licensing authority or license number. Its apparent business model is informational content supported by promotional or referral-style links, so the principal regulatory issue is the absence of independently verifiable operator and authorization disclosures rather than evidence that it directly sells a regulated financial product. Any apparent association with TON or Telegram should not be treated as proof of affiliation. The domain is established in registration terms, but that administrative fact does not resolve the security or operator-identity concerns raised elsewhere.
- The domain was registered on 2019-02-24 and is approximately 7.49 years old; the registrar is Porkbun LLC.
- Hosted on AS14061, identified as DIGITALOCEAN-ASN — DigitalOcean, LLC, US.
- The site’s TLS certificate is issued by YR1, uses Domain Validation (DV), and is valid through 2026-10-23T22:44:03+00:00.
What to Verify Next
Before any sensitive engagement, an organization should establish the real-world operator through independent corporate records and confirm whether the operator has any authorization relevant to the activity being promoted. Outbound exchange, bot, and community destinations should be validated through separately sourced official channels rather than relying on the site’s referrals. Security teams should also preserve the current page and perform controlled malware and link analysis before permitting access from enterprise environments.
- No sensitive form or wallet-connect execution was observed during the tested page behavior, limiting the directly observed interaction surface but not resolving the external reputation findings.
- The identity linkage remains assessed as likely rather than independently verified.
- The available content is informational in form and does not itself demonstrate custody, deposit handling, or direct sale of a financial product.
Summary Verdict
The overall posture is critical, with the available evidence unsuitable for treating the site as a trusted platform for sensitive interaction. Its informational presentation may support limited reference use, but it does not provide a sufficient basis for account, credential, wallet, or financial engagement.
Infrastructure Integrity
The website is protected by a CDN/WAF arrangement, and the observed address represents an edge endpoint rather than an independently observable origin. This provides a mitigating layer against direct infrastructure exposure, but protective delivery infrastructure does not offset the confirmed reputation concerns.
Closing Assessment
Enterprise access should remain restricted to passive, read-only review; logins, credential submission, wallet connections, and financial transactions should not be permitted.
Written analysis generated 2026-08-20 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
2 findings contributed to this verdict, raised by registration and ownership, analysis engine, behaviour in a sandbox, external reputation.
01 Governance Risk
- The public registration record for this domain is incomplete.Registration and ownership
rule:KF_WHOIS_INCOMPLETE
02 Sensitive Interaction Risk
- The analysis matched a pattern TrustSniffer treats as a direct threat to a visitor.Analysis engine
signal:direct_threat - Most of what the page loaded came from other domains rather than from this one.Behaviour in a sandbox
rule:BEHAV_EXTERNAL_RATIO_HIGH - An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it.External reputation
rule:EXT_BLACKLIST_CRITICAL
Identity verification
| Status | LIKELY |
|---|---|
| Identity score | 76/100 |
| Identity verification confidence | 76% |
- Trusted social count=2
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of ton-telegram.network.
- The request stayed on ton-telegram.network. It was not redirected to another domain. Clear
- Registration is published under Porkbun LLC. Clear
- DNS for this domain is served by porkbun.com, across 4 name servers. Noted
- The registration is paid up to 2027-02-24. Noted
- The earliest public archive of this site is from 2021-11-23. Clear
- It is hosted on DIGITALOCEAN-ASN, from a server in US. Noted
Domain intelligence
| Registrar | Porkbun LLC |
|---|---|
| Hosting | DIGITALOCEAN-ASN - DigitalOcean, LLC, US |
| Country | US |
| Server IP | 138.68.86.9 |
| Name servers | maceio.ns.porkbun.com, curitiba.ns.porkbun.com, salvador.ns.porkbun.com, fortaleza.ns.porkbun.com |
| SSL issuer | YR1 |
| SSL expiry | 2026-10-23 |
| Domain age | 7.49 years (continuous registration) |
| Domain expiry | 2027-02-24 |
| Archive first seen | 2021-11-23 |
| Archive snapshots | Not counted (archive lookup incomplete) |
| Reputation | VirusTotal: 15 flagged | AbuseIPDB: 0 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about ton-telegram.network at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.