ton-x402[.]pages[.]dev

The phishing domain ton-x402.pages.dev is currently active and hosts a fake exchange scam. The site masquerades as a platform for HTTP-native machine payments on the TON network. Despite being flagged by only 1 out of 95 vendors on VirusTotal, it has been identified as malicious by PhishDestroy and is listed on one public blocklist. The domain is registered with Cloudflare, Inc., and is hosted on an IP address located in Canada.

This domain was created on March 22, 2026, and detected by PhishDestroy the following day. The rapid detection highlights the effectiveness of PhishDestroy's monitoring system, which captures threats during the critical window before they are widely recognized by antivirus databases. The site has a platform risk score of 76 out of 100, indicating a significant threat level.

The SSL certificate for ton-x402.pages.dev is issued by Let's Encrypt, a common choice for phishing sites due to its free and automated nature. The use of a legitimate SSL certificate can mislead users into believing the site is secure. This tactic is often employed in phishing schemes to gain the trust of potential victims. The domain's association with Cloudflare, Inc. as both registrar and hosting provider is not uncommon in phishing operations, as it offers anonymity and protection against takedown efforts.

Overall, ton-x402.pages.dev represents a clear threat as a fake exchange scam, exploiting the TON network's branding to deceive users. The combination of a high-risk score, recent creation date, and minimal VirusTotal detection underscores the importance of early threat identification and proactive measures to mitigate potential damage.