# ton-7qz.pages.dev — SUSPICIOUS

> PhishDestroy identified ton-7qz.pages.dev as a crypto drainer scam. This active site was flagged by 4 of 95 VirusTotal vendors—avoid and verify immediately.

## Summary
PhishDestroy confirms ton-7qz.pages.dev is an active crypto drainer scam posing as a legitimate cryptocurrency service. The domain is currently operational and actively leveraging deceptive tactics to trick users into connecting wallets and approving malicious transactions. Threat intelligence indicates this campaign targets cryptocurrency users through social engineering and impersonation, with a focus on draining digital assets via fraudulent transaction approvals.


This domain resolves to IP 172.66.46.220 and was registered through Cloudflare, Inc. As of the latest scan, it is flagged by 4 of 95 VirusTotal security vendors and holds an SSL certificate issued by Google Trust Services. The domain is hosted on Cloudflare Pages, a legitimate service often abused by threat actors to rapidly deploy phishing infrastructure. While the SSL certificate adds a veneer of legitimacy, the combination of low VirusTotal detection and active hosting suggests this domain is part of a newly deployed or evolving campaign aimed at bypassing traditional security measures.


Given the elevated risk level and active status of ton-7qz.pages.dev, users are strongly advised to avoid interacting with this domain or any associated links. The presence of a Google Trust Services SSL certificate does not guarantee safety, as threat actors frequently exploit trusted issuers to enhance credibility. PhishDestroy recommends verifying unknown domains using its threat intelligence platform before engaging. If exposure has occurred—such as connecting a wallet or entering credentials—immediately revoke unauthorized permissions, transfer remaining assets to a secure wallet, and monitor for suspicious transactions. Organizations should consider blocking this domain and IP at the network perimeter to prevent user access.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 172.66.46.220

## Detection Status
- VirusTotal: 4 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/a07b2e56-2b5c-472a-87df-7b3d3ca0ea7f
- PhishDestroy: https://phishdestroy.io/domain/ton-7qz.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/ton-7qz.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/ton-7qz.pages.dev/
Last updated: 2026-03-22