block-noise-28.pages.dev was a short-lived impersonation phishing page hosted on a free Cloudflare Pages subdomain and aimed at crypto users. PhishDestroy flagged it on 2026-09-13, the same day the site was created. It went offline on 2026-09-20 and was still down and blocked by the hosting provider when last checked on 2026-10-19.
How the scam works
The page greeted visitors with the title "Desktop Browser Required", a device-check message rather than a recognizable brand name, while we classified the site as impersonation. Impersonation pages copy the look of a trusted wallet, exchange or service so that victims believe they are on the real thing. Once that trust is in place, the victim is asked to log in, enter a recovery phrase, or connect and approve a wallet. Whatever is entered goes to the operators, and that can mean a hijacked account or an emptied wallet.
Evidence
Independent detection was essentially absent. VirusTotal returned 0 detections out of 89 engines on 2026-09-19, six days after the site appeared, and PhishDestroy is the only blocklist carrying it. A clean scan result here reflects how quickly throwaway pages outpace vendor feeds, not that the site was safe. The provider's later block of the content backs the classification.
Infrastructure
The operators used a pages.dev subdomain with a disposable-looking name. They needed no domain purchase or registrar paperwork, and the page could go live within minutes. It sat on Cloudflare, Inc. address space geolocated to Canada and served a Google Trust Services certificate. That certificate comes automatically with the platform, so the padlock said nothing about the site's legitimacy. The page lasted about a week, from 2026-09-13 to 2026-09-20, which is typical of hit-and-run campaigns that burn one subdomain and move to the next.
What to do
If you typed a password or one-time code into this page, change that password right away. Do the same on any account that reuses it, and reset two-factor authentication if the codes may have been captured. If you entered a seed phrase, treat the wallet as compromised and move any remaining funds to a new wallet created on a clean device. If you connected a wallet and signed anything, review and revoke token approvals with a reputable approval checker. Defenders should block the domain and watch for similar randomly named pages.dev subdomains that use device-check lures like this one.
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
(US)
