# ton-x402.pages.dev — SUSPICIOUS

> PhishDestroy identifies ton-x402.pages.dev as a Microsoft Account phishing scam. Only 1 of 95 security vendors flagged this site. Check the full report.

## Summary
PhishDestroy identifies ton-x402.pages.dev as an active Microsoft Account phishing domain designed to steal login credentials. The site mimics Microsoft’s login interface to trick users into entering their email and password, which are then harvested by attackers for account takeover or further phishing campaigns. This domain is part of a broader trend where threat actors abuse legitimate cloud services like Cloudflare Pages to host convincing fake login portals, often targeting enterprise and personal Microsoft accounts. The page is currently resolving to IP 188.114.97.3 and leverages a Let’s Encrypt SSL certificate to appear legitimate.  

This domain was flagged by PhishDestroy with an elevated risk rating. According to VirusTotal, only 1 out of 95 security vendors currently detect this threat, underscoring the stealthy nature of such attacks. The domain is registered through Cloudflare, Inc., and hosted on Cloudflare Pages, which provides anonymity and operational flexibility for threat actors. While the exact creation date isn’t specified, the use of Cloudflare Pages suggests recent deployment, as attackers frequently leverage legitimate cloud platforms to evade detection and prolong their operations.  

If you visited ton-x402.pages.dev, do not enter any login credentials or personal information. Immediately close the browser and clear your cache to remove any session data. Monitor your Microsoft account for unusual activity, such as unrecognized logins or password changes. Enable multi-factor authentication (MFA) on your Microsoft account if you haven’t already. Report the domain to Microsoft’s phishing reporting tool or your IT security team. Avoid interacting with emails or messages that direct you to this domain, as they are likely part of the same phishing campaign.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 188.114.97.3

## Detection Status
- VirusTotal: 1 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/12646b25-98cc-4555-868f-24f9d5e2a8d6
- PhishDestroy: https://phishdestroy.io/domain/ton-x402.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/ton-x402.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/ton-x402.pages.dev/
Last updated: 2026-03-22