claims-saitachain.pages.dev is an impersonation phishing page that carried the title SAITASWAP and posed as a claim portal for the SaitaChain ecosystem. Its targets were SaitaChain and SaitaSwap token holders. PhishDestroy flagged it on 2026-09-04, the same day it went live. The site has been offline since 2026-09-16, and its content was blocked by the hosting provider as of 2026-10-19.
How the scam works
The subdomain name and the SAITASWAP title point to a fake claim page, a common lure that promises an airdrop, reward or token migration to existing holders. In schemes of this type, the visitor is asked to connect a wallet and then sign a transaction or approval presented as the claim step. That signature actually grants the attacker permission to move the victim's tokens, or it transfers them directly. Nothing is ever received, and assets leave the wallet as soon as the signature goes through.
Evidence
On 2026-09-17, 12 of 89 VirusTotal engines flagged the domain. The detections included BitDefender, ESET, Kaspersky, Fortinet, Forcepoint ThreatSeeker, G-Data, Gridinsoft and alphaMountain.ai, a spread of independent vendors rather than a single outlier. urlscan.io rated the page malicious and matched it to its generic crypto brand category. The domain is also listed by the wallet-focused blocklists MetaMask, ScamSniffer, SEAL and Enkrypt, alongside PhishDestroy. That means wallets using those lists would warn users before they connected.
Infrastructure
The page ran as a project on Cloudflare Pages, which accounts for the pages.dev address. It resolved to Cloudflare, Inc. network space geolocated to Canada. The project was detected on the day it appeared and went dark twelve days later, a short lifespan typical of disposable claim lures. Its Google Trust Services certificate was issued automatically by the platform, so the padlock said nothing about who operated the site.
What to do
If you connected a wallet and signed anything on this page, check your token approvals with a revocation tool right away and revoke any you did not intend to grant. If assets are still at risk, move them to a fresh wallet. If you entered a seed phrase, treat that wallet as compromised and transfer everything out immediately. Ignore follow-up messages offering refunds or recovery help, since these are a common second-stage scam. Defenders should block the domain, watch for similar claim-themed subdomains on free hosting platforms that use SaitaChain branding, and report new variants to Cloudflare and wallet blocklist maintainers.
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
JSDelivr is a free public CDN for open-source projects. It can serve web files directly from the npm registry and GitHub repositories without any configuration.
Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
(US)
