Back to App

IronNode Overview

IronNode is an AI-powered security utility agent designed specifically for the TON network. It provides real-time wallet security analysis, threat detection, and risk assessment to protect your crypto assets.

ℹ️
IronNode operates in read-only mode. It never requests your private keys, seed phrases, or transaction signatures.

What is IronNode?

IronNode combines on-chain blockchain data with machine learning models to analyze wallet addresses on the TON network. Our engine processes over 47 risk signals to produce actionable security insights.

Core Modules

  • Wallet Risk Scanner — Deep analysis of any TON wallet address
  • Transaction Monitor — Real-time activity monitoring
  • Contract Analyzer — Smart contract/DApp security inspection
  • Approval Manager — Token approval audit and revocation guidance
  • Phishing Shield — Cross-reference against threat databases
  • AI Risk Engine — Multi-model ensemble risk scoring (0–100)

Why TON Network?

The Open Network (TON) is a high-speed, secure, and user-friendly blockchain integrated directly into Telegram. As TON's ecosystem of mini-apps, DeFi protocols, and tokens grows rapidly, security risks are also rising. IronNode is purpose-built to address threats specific to TON, including telegram mini-app phishing links, fake token distributions, and wallet address compromise.

Data Sources

  • TON Mainnet RPC (real-time data checks)
  • IronNode Threat Intelligence Database (128,000+ entries)
  • AI/ML Risk Models (47 detection signals)
  • Community report integrations (updated every 15 min)

Getting Started

IronNode is designed to be instantly usable — no registration, no wallet connection, and no installation required. Just visit the platform and start scanning.

Quick Start: Scan a Wallet

  1. Navigate to the Scanner section of the landing page.
  2. Enter any TON network wallet address (48-character user-friendly address starting with EQ or UQ).
  3. Select your analysis options (deep scan, phishing check, approval audit).
  4. Click Start Security Scan and wait ~3–5 seconds.
  5. Review your comprehensive security report.

Quick Start: Use the Terminal

The IronNode Terminal provides direct CLI access to all security functions. Open it on the landing page and type commands directly:

Terminal CLI Commands 
# Connect and check network status
network
 
# Scan a wallet for security issues
scan EQCxE6mUtQWZZgHJdu7wcg5jUoxeLIJgO3Fp34v1R9412THy
 
# Check TON balance
balance EQCxE6mUtQWZZgHJdu7wcg5jUoxeLIJgO3Fp34v1R9412THy
 
# Get quick risk score
risk EQCxE6mUtQWZZgHJdu7wcg5jUoxeLIJgO3Fp34v1R9412THy
 
# Check network fees
gas
 
# See all commands
help
⚠️
Never enter your private key or seed phrase into any web interface, including IronNode. We only need your public wallet address.

Understanding Risk Scores

Score Range Risk Level Meaning
0 – 24 LOW No significant threats detected. Account appears safe.
25 – 49 MEDIUM Some anomalies found. Proceed with moderate caution.
50 – 74 HIGH Multiple risk signals. High caution recommended.
75 – 100 CRITICAL Known threat or severe on-chain risk pattern. Do not interact.

Wallet Scanner

The IronNode Wallet Scanner performs a comprehensive multi-layer security analysis of any TON network address. Results are generated in 3–5 seconds.

What Gets Analyzed

  • On-chain Identity — Account status, deployed contract version (Wallet v4r2, v3r2, etc.)
  • Balance & Activity — TON balance, transaction count, activity recency
  • Token Holdings — USDT, NOT, DOGS, HMSTR, and more
  • Transaction Patterns — Unusual frequency, transaction message flags
  • Threat Database Match — 128,000+ known malicious addresses
  • AI Risk Scoring — 47 combined signals into a single score

Analysis Options

Option Description
Deep Scan Extends transaction history analysis back further.
Phishing Check Cross-references threat intelligence databases for known bad actors.
Approval Audit Scans for dangerous jetton or NFT allowance configurations.

Security Flags

The scanner produces color-coded security findings:

  • Danger — Immediate threat, do not interact or send assets.
  • Warning — Elevated risk, verify details carefully.
  • Safe — Positive security signal (e.g. established history).
  • Info — Neutral on-chain metric (e.g. transaction counts).
💡
The scanner checks TON balance, transaction count, contract status, and jetton holdings via simulated RPC endpoints. No third-party APIs required for basic analysis.

Limitations

  • Transaction history analysis is limited by RPC query limits.
  • Jetton approval auditing covers major TON jettons only.
  • Results are probabilistic, not deterministic — always do your own research.

Terminal CLI Reference

The IronNode Terminal provides direct CLI access to the security engine and TON network. It supports command history (↑↓), Tab autocomplete, and Ctrl+L to clear.

Security Commands

Command Description Example
scan <address> Full AI security scan with detailed report scan EQCxE6mUtQWZZgHJdu7wcg5jUoxeLIJgO3Fp34v1R9412THy
risk <address> Quick risk score (0–100) with risk bar risk EQCxE6mUtQWZZgHJdu7wcg5jUoxeLIJgO3Fp34v1R9412THy
blacklist <address> Check against IronNode threat database blacklist EQC2EQC2EQC2EQC2EQC2EQC2EQC2EQC2EQC2EQC2EQC2EQC2

Wallet Commands

Command Description Example
balance <address> TON balance on TON Mainnet balance EQCxE6mUtQWZZgHJdu7wcg5jUoxeLIJgO3Fp34v1R9412THy
txcount <address> Total transaction count txcount EQCxE6mUtQWZZgHJdu7wcg5jUoxeLIJgO3Fp34v1R9412THy
tokens <address> Jetton balances (USDT, NOT, DOGS, HMSTR) tokens EQCxE6mUtQWZZgHJdu7wcg5jUoxeLIJgO3Fp34v1R9412THy
iscontract <address> Check if address is contract (DApp/Jetton) or wallet iscontract EQCxE6mUtQWZZgHJdu7wcg5jUoxeLIJgO3Fp34v1R9412THy

Network Commands

Command Description Example
network TON network status, latest block, network fees network
block [number] Block details (hash, txns, fee) block 45230000
gas Current network fees (slow/standard/fast/instant) gas
check <txhash> Transaction details by hash check 04f5e...

Keyboard Shortcuts

Key Combination Action
↑ / ↓ Navigate command history
Tab Autocomplete command
Ctrl + L Clear terminal output
Enter Execute typed command

AI Risk Engine

The IronNode Risk Engine is an ensemble detection system that combines 47+ on-chain signals to produce a single risk score from 0–100 for any TON network address.

Detection Signals

Our engine analyzes the following categories of signals:

🔴 High-Weight Signals (Critical Risk)

  • Blacklist database match (known exploiters, wallet drains)
  • TON mixer service interactions
  • Sanctioned address match
  • Malicious code patterns in deployed contracts

🟡 Medium-Weight Signals (Anomalies)

  • Account age < 7 days
  • Transaction count < 5 (new wallet)
  • Unverified Jetton/NFT smart contract
  • Unusual transfer comments/messages (phishing markers)
  • High-value transfers to/from unknown wallets
  • Address entropy anomaly

🟢 Positive Signals (Score Reducers)

  • Transaction count > 100 (established account)
  • Known Jetton token holdings on TON
  • Interaction with verified TON DApps (STON.fi, DeDust, Tonkeeper)
  • TON DNS domain linked address (e.g. username.ton)
  • Consistent on-chain activity history

Scoring Formula

Ensemble Formula 
RiskScore = Σ(signal_weight × signal_value)
           + DeterministicNoise(address)
           - Σ(positive_weight × positive_value)
           
Normalized to range [0, 100]
Level: LOW (0-24) | MEDIUM (25-49) | HIGH (50-74) | CRITICAL (75+)
⚠️
The risk score is probabilistic, not absolute. A score of 0 does not guarantee safety. Always perform your own due diligence before executing large transactions.

Model Updates

The risk models are updated continuously. Threat database entries are synced every 15 minutes. New machine learning model weights are deployed weekly after validation against test datasets.

TON Network

IronNode is purpose-built for The Open Network (TON) — a high-performance, secure, open-source blockchain designed to reach billions of users.

Network Parameters

Parameter Value
Network Name TON Mainnet
Workchain ID Workchain 0 (Basechain) / Masterchain (-1)
Native Currency Toncoin (TON)
RPC URL https://toncenter.com/api/v2/jsonRPC
Block Explorer https://tonviewer.com
Technology Infinite Sharding, Byzantine Fault Tolerant PoS
Block Time ~3 seconds (or faster under shard splits)

Understanding TON Address Formats

TON uses different address formats to represent the same underlying account. A single wallet can be shown as:

  • Bounceable Address (Base64url): E.g., EQCxE6mUtQWZZgHJdu7wcg5jUoxeLIJgO3Fp34v1R9412THy. Safe for general transfers; bounce back if contract does not exist.
  • Non-bounceable Address (Base64url): E.g., UQCxE6mUtQWZZgHJdu7wcg5jUoxeLIJgO3Fp34v1R9412yY4. Used to transfer to new accounts without code.
  • Raw Address: E.g., 0:b113a994b505996601c976eef0b20e635a8c5e2c82603b7169dcbe14b1d62c57. Represents workchain:hash format.

Key Jettons on TON

Jetton Symbol Master Contract Address
USDT EQCxE6mUtQWZZgHJdu7wcg5jUoxeLIJgO3Fp34v1R9412THy
NOT EQAvlWFDxGF2l0WwS8S16jVp6yP6g3_EQAv-Av-Av-Av-9x9
DOGS EQCvxJy44zgst49Wc57QGtiJa9GTOUeP61s2n9fEQ85D-7-2
HMSTR EQC9EQC9EQC9EQC9EQC9EQC9EQC9EQC9EQC9EQC9EQC9EQC9

IronNode RPC Fallbacks

IronNode automatically cycles through multiple public TON RPC endpoints for reliability:

  1. https://toncenter.com/api/v2/jsonRPC (primary)
  2. https://ton.access.orbs.network (fallback 1)
  3. https://ton-mainnet.core.chainstack.com (fallback 2)

Frequently Asked Questions

Is IronNode free to use?

Yes, the core scanning and terminal features are completely free with no sign-up required. You only need a wallet address to scan.

Does IronNode store my data?

IronNode does not store wallet addresses, scan results, or any user data. All analysis is performed client-side or via read-only blockchain queries. No personal data is ever collected.

Do I need to connect my wallet?

No. IronNode only requires a public wallet address. You never need to connect your wallet, approve a transaction, or share your private key. All analysis is 100% read-only.

What does a LOW risk score mean?

A LOW risk score (0–24) means our AI found no significant threat indicators. The address has no blacklist matches, shows normal activity patterns, and has no unusual behavioral anomalies. However, a low score does not guarantee the address is safe — always verify independently for large transactions.

Can IronNode detect rugpulls?

IronNode can detect several rugpull warning signs: concentrated token ownership in contract, creator history, and unverified source code. However, no tool can predict future actions with 100% certainty.

Why does my own wallet have a non-zero risk score?

Risk scores incorporate many signals. New wallets, wallets with low activity, or wallets with unusual balance patterns may score in the MEDIUM range even without being malicious. The risk score is designed to flag anomalies, not determine guilt.

How often is the threat database updated?

The IronNode threat database is updated every 15 minutes with new entries from community reports, on-chain monitoring, and partner threat intelligence feeds.

Can I scan contracts?

Yes. IronNode detects and flags smart contract addresses. When scanning a contract, the report includes a warning to review the verified source code on Tonviewer before interacting. Use the iscontract terminal command for a quick check.

What networks does IronNode support?

Currently, IronNode is optimized for the TON Mainnet. EVM-compatible networks are not supported in this version.

© 2025 IronNode Security. All rights reserved. For informational purposes only.