blockcheck.pages.dev: badware

[c2qd]

Prerequisites

• This is NOT a YouTube, Facebook, Twitch or a shortener/hosting site report. These sites MUST be reported by clicking their respective links.
• I read and understand the policy about what is a valid filter issue.
• I verified that this issue is not a duplicate. (Use this button to find out.). Comment in the old issue threads even when they are closed or even if you have a different problem.
• I did not remove any of the default filter lists, or I have verified that the issue was not caused by removing any of the default lists.
• I did not enable additional or non-default filter lists, or I have verified that the issue still occurs without enabling additional filter lists.
• I do not have custom filters/rules, or I have verified that the issue still occurs without custom filters/rules.
• I have verified that the web browser's built-in content blocker/tracking protection, network wide/DNS blocking, or my VPN is not causing the issue.
• I have turned off all other extensions and the issue still persists. (exception "Firefox Multi-Account Containers").
• If this is about a breakage or detection, I have verified that it is caused by uBlock Origin and isn't a site or browser issue.
• I have verified that the browser I am using is up to date with no pending updates.
• I did not answer truthfully to ALL the above checkboxes.

URL(s) where the issue occurs.

https://blockcheck.pages.dev

Description

It claims to be a tool for checking blocked users on X (Twitter) accounts.
It prompts users to enter their ID and password, then hijacks the account.
Reference: https://x.com/twilog_official/status/1981185621491404983

Browser name and version

Firefox 144.0

Other extensions used

none

Country

No response

Screenshot(s)

Screenshot(s)

Configuration

Details

uBlock Origin: 1.67.0
Firefox: 144
filterset (summary):
 network: 163468
 cosmetic: 55959
 scriptlet: 24119
 html: 2445
listset (total-discarded, last-updated):
 default:
  user-filters: 0-0, never
  ublock-filters: 41475-71, now
  ublock-badware: 11117-31, now
  ublock-privacy: 3524-2, now
  ublock-unbreak: 2750-1, now
  ublock-quick-fixes: 385-13, now
  easylist: 82411-152, now
  easyprivacy: 54715-44, now
  urlhaus-1: 31195-5, now
  plowe-0: 3443-932, now
  JPN-1: 16441-82, now
filterset (user): [empty]
userSettings: [none]
hiddenSettings: [none]
supportStats:
 allReadyAfter: 1815 ms
 maxAssetCacheWait: 20 ms
 cacheBackend: indexedDB

[c2qd]

Additional domain of the same type:
hxxps://checkx.pages[.]dev/1/login
hxxps://xcheckx.pages[.]dev
hxxps://blockchecker-8ka.pages[.]dev

[c2qd]

checkx.pages[.]dev has been suspended by Cloudflare.
URLScan

• Edit: Strangely enough, Cloudflare seems to have only disabled the checkx.pages[.]dev root directory, while the subdirectories below it appear to be functioning normally.
• In the case of this page, /1/login (where the number could be 2, 3, or 4) also displays the same phishing page. I recall that attackers were sharing URLs including /1/login, rendering Cloudflare's countermeasure completely ineffective.

blockcheck.pages[.]dev is displaying a message that states, "This address has been registered to prevent reuse, as it was previously used for phishing," which is being asserted by a third party unrelated to Cloudflare. (ref: X@rlattorra)
The current page mentions an organization called the "Transparency Promotion Association"(original: "透明性推進協会"), but this appears to be merely a name made up on the spot by that individual.
URLScan

(Edit2: In light of the above, I believe the filter rules should be kept in place. In the case of blockcheck.pages[.]dev, it is merely displaying a claim of protection from a third party, which offers no real guarantee of safety.)

[c2qd]

Additional:
hxxps://blockchecker5.pages[.]dev
URLScan

[c2qd]

This one too.
hxxps://blck.pages[.]dev
/1/login, /2/login, /3/login, and /4/login are the actual pages. This has a structure similar to checkx.pages[.]dev.

[c2qd]

Additional:
hxxps://blockchecker5.pages[.]dev
URLScan

Could you add this one as well?

[c2qd]

Additional:
https://gocheck.pages.dev
URLScan

[c2qd]

Additional:
hxxps://checkfv.pages.dev URLScan
hxxps://xblocktest.pages.dev URLScan
Regarding xblocktest, the actual content is /1/login, /2/login, /3/login, or /4/login.