bridge-kind-52.pages.dev was an impersonation phishing page hosted on a free Cloudflare Pages subdomain. Visitors were shown a screen titled "Desktop Browser Required." PhishDestroy flagged it on 2026-09-13, the same day the subdomain was created. The site has been offline since 2026-09-20, and the hosting provider has blocked its content. It was still down when last checked on 2026-10-19.
How the scam works
Impersonation pages copy the look of a trusted service so visitors will type in logins or recovery phrases, or approve actions they would otherwise refuse. A "Desktop Browser Required" screen is a common gate in these setups. It pushes people off phones and onto desktop browsers, where wallet extensions and saved sessions are available to target. The title shows a device check rather than a branded login, while our classification is impersonation. Anyone who continued past the gate risked handing over credentials or wallet secrets to whoever ran the page.
Evidence
Independent detection was thin. When VirusTotal checked the site on 2026-09-19, only URLQuery flagged it, out of 89 engines. PhishDestroy is the only blocklist carrying it. That pattern fits a page that lived for about a week, too short for most vendors to catch it. Low vendor coverage here reflects the site's brief lifespan, not evidence that it was safe.
Infrastructure
The subdomain was created on 2026-09-13 and detected that same day, so it was a fresh, throwaway deployment rather than an aged domain. It ran on Cloudflare Pages behind Cloudflare, Inc. network space geolocated to Canada. The free pages.dev hostname gave the operator a working HTTPS address with no registration cost. The provider's content block confirms the deployment was disabled at the platform level.
What to do
If you entered a password on this page, change it right away, starting with any account that reuses it. Then enable app-based 2FA and sign out of other active sessions. If you typed a seed or recovery phrase, consider that wallet compromised and move any remaining funds to a newly created wallet. Watch for follow-up messages that cite this site or pretend to be support staff offering recovery help. Defenders should block the pages.dev subdomain, watch for sibling Cloudflare Pages deployments with similar random names, and treat "Desktop Browser Required" gates as a phishing indicator.
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
(US)
