ton-2mj[.]pages[.]dev

Analysis of ton-2mj.pages.dev shows a short-lived credential‑phishing site that was taken offline shortly after detection. The domain was registered on March 23 2026 through Cloudflare, Inc. and resolves to the Cloudflare‑owned address 172.66.47.162, which is geolocated to Canada. The TLS certificate is issued by Google Trust Services under the WE1 hierarchy, indicating a valid HTTPS endpoint despite the malicious purpose. An HTTP request returns a 403 status, suggesting the hosting provider has blocked access after the site was reported.

The page title reported by scanners is “TonTG”, but no further content has been publicly captured. Technical fingerprinting identifies jQuery, HTTP/3, HSTS enforcement and the Cloudflare network, all typical of fast‑deployed phishing infrastructure. Reputation metrics are uniformly negative: Gridinsoft assigns a trust score of 0 / 100, nine of ninety‑four VirusTotal scanners flag the domain, PhishDestroy has listed it, and it appears on a single external blocklist. The combination of recent creation, Cloudflare‑only hosting, a valid Google‑signed certificate, and a low‑trust score aligns with known credential‑phishing campaigns that exploit trusted TLS to increase user confidence.

Uncertainty remains regarding the specific target brand or the credential‑collection backend, as the page title does not reveal the intended victim and no malware hashes have been published. Defenders should immediately block both the domain and its resolved IP address at the perimeter, ensure endpoint protection solutions ingest the nine VirusTotal detections, and add the domain to internal threat intelligence feeds. Continuous monitoring of new Cloudflare‑registered subdomains that share the “TonTG” title or similar jQuery‑based pages is advised, as threat actors often recycle the same tooling across fresh domains. Given the rapid takedown, the risk is currently mitigated, but the observed infrastructure suggests a potential for re‑deployment.