btcme[.]pages[.]dev

Analysis indicates that btcme.pages.dev is an active infrastructure hosting a wallet/seed phishing operation targeting Bitcoin users. The site presents the page title “BTC Mnemonic Encryptor — Secure, Offline, and User‑Friendly Bitcoin Mnemonic Encryption”, explicitly referencing Bitcoin mnemonic encryption, which aligns with the listed scam type of Wallet/Seed Phishing. The domain was registered on 26 March 2026 through Cloudflare, Inc., and resolves to the Cloudflare‑owned IP address 188.114.96.3 located in Canada. DNS resolution is served by crystal.ns.cloudflare.com and wesley.ns.cloudflare.com, and the HTTP response returns status 200 with HSTS enabled and HTTP/3 support, confirming a modern CDN configuration. The TLS certificate is issued by Google Trust Services under the WE1 root, indicating a valid HTTPS endpoint. Threat intelligence feeds have flagged the domain on a public blocklist. VirusTotal scans show that one out of ninety‑four security vendors flagged the domain, and an unnamed security score rated it 0 / 100, reinforcing the malicious classification. No additional content has been captured beyond the page title; the exact HTML or form structure remains unverified. Defenders should block the domain at the network perimeter, update URL filtering lists, and monitor for any related subdomains created after the March 2026 registration. Continuous re‑evaluation is advised, as the site may evolve its payload or landing pages.