Is tonko.app safe?
http://tonko.app/
Checked on
How we checked
Coverage: strong · 5 of 6 applicable core capabilities
- Antivirus (57 of 92 engines answered) · saved result: did not fully complete
- Google Safe Browsing: completed
- page reading: completed
- page capture: completed
- domain records: completed
- web research: completed
A young family pocket-money app site whose download button leads to Google Play, with one stale antivirus phishing label and thin operator disclosure.
tonko.app is the marketing page for TONKO, an Android app that acts as a family ledger for pocket money, with children using a nickname and avatar and parents approving settings. The site's download control opens the Google Play listing, subscriptions and refunds run through Google Play, and the Terms name the developer as an individual in Croatia with a domain-matched contact email. Nothing in the review shows a payment trap, a fake storefront or a malicious download, but the domain is only 44 days old, the operator gives no company registration, address or phone, and a saved antivirus snapshot carries a single phishing categorisation. That mix fits Low Risk rather than Safe.
Saved site captureCaptured safely during this scan1 antivirus engine flagged this URLWebrootSaved antivirus result from Sep 27, 2026Where this site sits
- Dangerous1–20
- High Risk21–44
- Moderate Risk45–69
- Low Risk70–84
- Safe85–100
The score combines saved evidence strength and analysis quality. Coverage is reported separately.
Why 78/100
Low Risk covers scores 70–84. 3 findings pulled the score down; 4 pushed it up.
What pulled the score down
- StrongA primary play, convert, continue, or download control opened an unrelated external destination.
- Strong1 independent antivirus family reported an adverse result. This comes from a saved antivirus observation rather than a new submission, so treat the detection as real but confirm the timing.
- ModerateThe domain is 44 days old and the operator is named only as an individual with a domain email, with no company registration, address or phone.
What pushed the score up
- SupportsThe site states the app is a family ledger for pocket money with no bank card, markets or trading, and children use only a nickname and avatar.
- SupportsIndependent product write-ups describe TONKO as a pocket-money app for children aged 6 to 14 that teaches saving without ads or real-world banking.
- SupportsSafe Browsing returned no warning, TLS is valid, and the shared hosting address has an abuse score of 0 out of 100.
- SupportsContact email on the site's own domain (hello@tonko.app).
No points per finding are stored for this report: our analysis weighed all findings together to set the score. Each finding shows its saved severity instead (Decisive, Strong, Moderate or Minor).
01 · Investigation Brief
Investigation Brief
tonko.app is the marketing page for TONKO, an Android app that acts as a family ledger for pocket money, with children using a nickname and avatar and parents approving settings. The site's download control opens the Google Play listing, subscriptions and refunds run through Google Play, and the Terms name the developer as an individual in Croatia with a domain-matched contact email. Nothing in the review shows a payment trap, a fake storefront or a malicious download, but the domain is only 44 days old, the operator gives no company registration, address or phone, and a saved antivirus snapshot carries a single phishing categorisation. That mix fits Low Risk rather than Safe.
A pocket-money app page that hands billing to Google Play
The page markets TONKO as a family ledger for pocket money and states plainly that it holds no bank card, markets or trading, so the product is a tracking tool rather than a financial service. Children are described as using only a nickname and an avatar, with grown-up settings behind a parent's approval or family PIN.
The main download control opens the Google Play listing for the app, and the Terms route subscriptions through Google Play monthly or yearly at the price shown before confirmation, with automatic renewal until cancelled there. Extra outfit packs are one-time purchases that only a parent can make, and refund requests go to Google under the Play refund policy.
Outbound links stay inside that app-store path plus the developer's own personal and studio sites, and no affiliate or presell network was found in the link graph. Independent write-ups describe the same product as a pocket-money app for children aged 6 to 14 that teaches saving without ads or real-world banking.
Clean connection checks, but a stale phishing label and a thin paper trail
The browser threat feed returned no threat warning, the saved TLS check found a valid encrypted connection, and the shared hosting address carries an abuse confidence score of 0 out of 100 across 284 saved reports. Those results mean no live technical threat was confirmed, not that the operator has been vetted.
One saved antivirus snapshot records a single engine family, Webroot, categorising the domain as phishing and other frauds while the rest of the engines returned harmless. That snapshot is stale, so it is a reason to keep watching rather than proof of a live phishing page, and it is not corroborated by the Safe Browsing result.
The registrable domain is 44 days old, and the Terms name the developer as an individual in Croatia with a contact mailbox on the site's own domain but no company registration, postal address or phone number. For an app aimed at children, that leaves the legal entity and data-protection contact unverified, which is the main reason this site does not reach the Safe band.
Why the score is 78
The saved checks found no material threat, but the evidence was not strong enough for the highest Safe tier.
02 · Security Evidence
Security evidence
Antivirus Engines
1/ 92
detectionsSaved analysis from September 27, 2026 - stale
1 engine flagged this URL
Every saved adverse engine is listed below. The full provider matrix remains available for audit.
- Malicious
- 1
- Suspicious
- 0
- Total
- 92
| Engine | Finding |
|---|---|
| WebrootMalicious | malicious |
All 92 engine results
- Webroot - Malicious
- 0xSI_f33d - Unrated
- Abusix - Clean
- Acronis - Clean
- ADMINUSLabs - Clean
- AILabs (MONITORAPP) - Clean
- AlienVault - Clean
- alphaMountain.ai - Unrated
- AlphaSOC - Unrated
- Antiy-AVL - Clean
- ArcSight Threat Intelligence - Unrated
- AutoShun - Unrated
- Bfore.Ai PreCrime - Unrated
- BitDefender - Clean
- Bkav - Unrated
- BlockList - Clean
- Blueliv - Clean
- Certego - Clean
- ChainPatrol - Unrated
- Chong Lua Dao - Clean
- CINS Army - Clean
- CRDF - Clean
- Criminal IP - Clean
- CSIS Security Group - Unrated
- CTX AI - Clean
- Cyan - Unrated
- Cyble - Clean
- CyRadar - Clean
- desenmascara.me - Clean
- DNS8 - Unrated
- Dr.Web - Clean
- EmergingThreats - Clean
- Emsisoft - Clean
- Ermes - Unrated
- ESET - Clean
- ESTsecurity - Clean
- Forcepoint ThreatSeeker - Clean
- Fortinet - Clean
- Fortra - Unrated
- G-Data - Clean
- GCP Abuse Intelligence - Unrated
- Google Safe Browsing - Clean
- GreenSnow - Clean
- GreyNoise - Unrated
- Gridinsoft - Unrated
- Guardpot - Unrated
- Heimdal Security - Clean
- Hunt.io Intelligence - Unrated
- IPsum - Clean
- Juniper Networks - Clean
- K7AntiVirus - Unrated
- Kaspersky - Unrated
- LevelBlue - Clean
- Lionic - Clean
- Lumu - Unrated
- Malwared - Clean
- MalwarePatrol - Clean
- MalwareURL - Unrated
- Mimecast - Unrated
- Netcraft - Unrated
- OpenPhish - Clean
- PhishFort - Unrated
- Phishing Database - Clean
- Phishtank - Clean
- PREBYTES - Clean
- PrecisionSec - Unrated
- Quick Heal - Clean
- Quttera - Clean
- Rising - Clean
- SafeToOpen - Unrated
- Sangfor - Clean
- Sansec eComscan - Unrated
- Scantitan - Clean
- SCUMWARE.org - Clean
- Seclookup - Clean
- Snort IP sample list - Unrated
- SOCRadar - Unrated
- Sophos - Clean
- StopForumSpam - Clean
- Sucuri SiteCheck - Clean
- Synthient - Unrated
- ThreatHive - Clean
- URLhaus - Clean
- URLQuery - Unrated
- Viettel Threat Intelligence - Clean
- VIPRE - Unrated
- ViriBack - Clean
- VX Vault - Clean
- Xcitium Verdict Cloud - Unrated
- Yandex Safebrowsing - Clean
- ZeroCERT - Clean
- ZeroFox - Unrated
How security vendors categorise this site
- WebrootPhishing and Other Frauds
- Forcepoint ThreatSeekernewly registered websites
- Googlefinancial_services
Each vendor’s own label for the site, saved with the antivirus result. Labels are separate from the engine verdicts above and can disagree with each other.
Security Scans
Checked against the browser threat feeds available to this scan — no hit.
What we observed
Visual context from the captured page
Header shows the TONKO wordmark with a small sparkle accent, navigation items One app, How it works, What kids learn, Money Lab, Safety, Questions, a dark 'Download' button with a play icon, and an 'HR' language selector. Hero headline reads 'Little habits. A lifetime ahead.' with subtext describing TONKO as teaching kids how money works by earning, sharing and saving, 'One app for the whole family.' Two hero buttons: a dark 'Try TONKO' button with arrow and an outlined 'Explore the Time Machine' button. Three checkmark badges under the hero buttons read 'Never touches real money', 'No ads', 'Parents approve'. A phone mockup shows a child's dashboard: 'Hey, Leo!', pocket money €94.50, jars Spend €12.00, Save €67.50, Grow €10.00, a 'My first bike' goal progress bar, and floating notifications 'Well done, Leo! +€2.00 for tidying up' and 'Goal streak 4 weeks of saving'.
What the captured page showed
5 observations- 01
Header shows the TONKO wordmark with a small sparkle accent, navigation items One app, How it works, What kids learn, Money Lab, Safety, Questions, a dark 'Download' button with a play icon, and an 'HR' language selector.
- 02
Hero headline reads 'Little habits. A lifetime ahead.' with subtext describing TONKO as teaching kids how money works by earning, sharing and saving, 'One app for the whole family.'
- 03
Two hero buttons: a dark 'Try TONKO' button with arrow and an outlined 'Explore the Time Machine' button.
- 04
Three checkmark badges under the hero buttons read 'Never touches real money', 'No ads', 'Parents approve'.
- 05
A phone mockup shows a child's dashboard: 'Hey, Leo!', pocket money €94.50, jars Spend €12.00, Save €67.50, Grow €10.00, a 'My first bike' goal progress bar, and floating notifications 'Well done, Leo! +€2.00 for tidying up' and 'Goal streak 4 weeks of saving'.
What the page says about itself
Quoted from the pages we read: the site's own words, not our findings.
- Page title
TONKO — Pocket money app that teaches kids about money
- Meta description
Pocket money app for families: kids earn through jobs, save for goals and learn money skills, and a parent approves every step. No ads. Free on Android.
Pages we read
- Main page/enRead
- Terms/en/termsRead
03 · Investigation Story
Investigation story
What the site claims
TONKO — Pocket money app that teaches kids about money
What we observed
The page content was captured and checked alongside 57 antivirus results.
What independent research found
4 external findings were saved and compared with the page evidence.
What remains unverified
1 of the 6 applicable core capabilities did not complete, so those gaps remain visible in the coverage ledger.
What kind of site and risk is this?
Threat category
No threat category confirmed
Service and business model
Saas
Observed behavior
Evidence behind this classification
- 01The download control opens the Google Play listing for the app rather than an off-brand merchant or affiliate destination.
- 02A primary play, convert, continue, or download control opened an unrelated external destination.
- 03Subscriptions, renewal, cancellation and refunds are handled through Google Play, and the Terms disclose automatic renewal and the non-refundable default.
Web research findings
Independent findings for tonko.app, including public complaints, named review sources, registration records, and look-alike-domain evidence.
- roipad.com (product origin analysis)open
"I'm the maker of TONKO!"
- ChatGateopen
"TONKO is a pocket-money app for families with children aged 6 to 14"
- HuntScreensopen
"TONKO is a family pocket money app that teaches children financial habits through earning, saving, and goal-setting without ads or real-world banking."
- thistools.appopen
"TONKO is a family ledger for pocket money you already give"
Reputation Sources
How this domain rates across independent threat-intelligence and blocklist providers.
04 · Domain & Infrastructure
Domain & infrastructure
The plumbing behind the site — who registered it, how it’s encrypted, where it’s hosted, and where it links out. A valid certificate or a calm server doesn’t mean the business is honest — scam sites pass these checks too.
Infrastructure map
- Domaintonko.app
- Redirects totonko.app
- Hosted byVercel, Inc
- Referencesplay.google.com · boiledeggs.studio
Domain Timeline
- Sep 20, 2026Domain registered
First appeared in WHOIS records — 44 days old when this review was saved.
- Nov 4, 2026Saved security review — Rated Low Risk
This saved scan found no material threat, but the evidence was not strong enough for the highest Safe tier.
Contact Verification
Saved contact details can help identify the operator. Their presence supports traceability; it does not prove the business is trustworthy.
- Contact email on the site's own domain (hello@tonko.app).
Domain & Encryption
Certificate issued for *.tonko.app.
A shared content-delivery network address answers for many sites, so it is not the site's own server and says nothing about who runs it.
Payment providers the page loads
None seen among the outside domains we saved.
Read from the first 20 outside domains the page loads and the shop platform it uses; the web server and platform rows are under Hosting & Technology. A payment script on the page does not prove the shop accepts that method at checkout, or that you are protected.
Redirect Chain
- 1308http://tonko.app/
- 2307https://tonko.app/
- 3206https://tonko.app/en
Server Reputation
Referenced Domains
Outbound domains this page links to or loads resources from. Each links to its own security scan.
05 · Evidence Ledger
Evidence ledger
- Antiviruspartial
- Browser threat feedcomplete
- Page contentcomplete
- Analysiscomplete
- Visual evidencecomplete
The conclusion is supported by the evidence saved with this report.
Technical threat
suspiciousMalware, phishing, credential theft and hostile infrastructure.
A primary play, convert, continue, or download control opened an unrelated external destination. · 1 independent antivirus family reported an adverse result. This comes from a saved antivirus observation rather than a new submission, so treat the detection as real but confirm the timing.
Operator / customer risk
suspiciousComplaints, withdrawals, business conduct and commercial traps.
The domain is 44 days old and the operator is named only as an individual with a domain email, with no company registration, address or phone.
Source coverage and freshness
Status shows whether usable evidence was saved; finding shows what that evidence observed.
| Source | Result | Completion | Finding | Freshness |
|---|---|---|---|---|
| Antivirus | 1 of 92 engines flagged | Limited | Adverse | stale fallback · analysed Sep 27, 2026 |
| Browser protection | No browser threat-list match | Completed | No adverse finding | this scan · Nov 4, 2026 |
| Page content | Page fetched · HTTP 200 | Completed | No adverse finding | this scan · Nov 4, 2026 |
| Visual evidence | 5 visible observations saved with the page capture | Completed | No adverse finding | this scan · Nov 4, 2026 |
| Independent research | 4 independent findings were saved | Completed | No adverse finding | this scan · Nov 4, 2026 |
- Antivirus
- Result1 of 92 engines flagged
- CompletionLimitedFindingAdverse
- Freshnessstale fallback · analysed Sep 27, 2026
- Browser protection
- ResultNo browser threat-list match
- CompletionCompletedFindingNo adverse finding
- Freshnessthis scan · Nov 4, 2026
- Page content
- ResultPage fetched · HTTP 200
- CompletionCompletedFindingNo adverse finding
- Freshnessthis scan · Nov 4, 2026
- Visual evidence
- Result5 visible observations saved with the page capture
- CompletionCompletedFindingNo adverse finding
- Freshnessthis scan · Nov 4, 2026
- Independent research
- Result4 independent findings were saved
- CompletionCompletedFindingNo adverse finding
- Freshnessthis scan · Nov 4, 2026
07 · Safety FAQ
Safety FAQ
Answered from the saved verdict and evidence in this report.
Is tonko.app a scam or is it safe?
Is tonko.app safe to use?
Has tonko.app been flagged by antivirus engines?
Is tonko.app on any phishing or malware blacklists?
How old is the tonko.app domain?
Does tonko.app have a valid SSL certificate?
Where is tonko.app hosted?
How often is the tonko.app report updated?
08 · Final Verdict
Final verdict
A young family pocket-money app site whose download button leads to Google Play, with one stale antivirus phishing label and thin operator disclosure.
tonko.app is the marketing page for TONKO, an Android app that acts as a family ledger for pocket money, with children using a nickname and avatar and parents approving settings. The site's download control opens the Google Play listing, subscriptions and refunds run through Google Play, and the Terms name the developer as an individual in Croatia with a domain-matched contact email. Nothing in the review shows a payment trap, a fake storefront or a malicious download, but the domain is only 44 days old, the operator gives no company registration, address or phone, and a saved antivirus snapshot carries a single phishing categorisation. That mix fits Low Risk rather than Safe.
09 · Community
Community
Are you the owner of tonko.app?Verify and reply