# toncat.pages.dev — SUSPICIOUS

> Toncat.pages.dev is a crypto drainer impersonating Toncoin (TON). Check this domain on PhishDestroy: VirusTotal 0/95, operates via Google Trust Services and.

## Summary
PhishDestroy identifies Toncat.pages.dev as an active crypto drainer impersonating Toncoin (TON), delivered via a fake login portal hosted on Cloudflare Pages. The domain leverages a Google Trust Services SSL certificate and resolves to IP address 188.114.97.3. Infrastructure is registered through Cloudflare, Inc., indicating an effort to cloak malicious operations behind a reputable CDN. No known drainer kit signature has been publicly released, suggesting potential use of a novel or obfuscated JavaScript-based wallet interceptor.  This domain exhibits minimal detection coverage, with zero detections out of 95 on VirusTotal at the time of writing. The domain was registered under Cloudflare, Inc., resolves to IP 188.114.97.3, and operates with a valid Google Trust Services SSL certificate. It remains unlisted on Google Safe Browsing (GSB) and has not been blocked by major threat intelligence platforms. This low detection profile increases the risk of successful user compromise, particularly in environments where domain reputation is not rigorously monitored.  Current status remains active, with no takedown actions observed. PhishDestroy flagged this domain under seed 2ccc66 and continues to monitor its behavior. Immediate risk to users interacting with Toncat.pages.dev is high due to the absence of automated detection and the use of a convincing impersonation strategy. Users are strongly advised to verify links using PhishDestroy or other threat intelligence services before engaging with any Toncoin-related login pages. Remaining risk includes potential wallet drain, credential theft, and further phishing expansion via the same infrastructure.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 188.114.97.3

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/domains/toncat.pages.dev
- PhishDestroy: https://phishdestroy.io/domain/toncat.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/toncat.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/toncat.pages.dev/
Last updated: 2026-04-09