TONResolver Blockchain Dead-Drop C2 Resolution via tonapi.io from Script/Runtime Processes

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects DNS queries for known TON blockchain related domains or rare top-level domains (shop, bond, sbs, cfd) initiated by common script interpreters or runtime processes like PowerShell, node, cmd, or wscript. This activity is often associated with the TONResolver, which may be used by malware for C2 communications, dead-drop resolution, or as a post-resolution staging mechanism.