bridge-satoshivm-ajd[.]pages[.]dev

The domain bridge-satoshivm-ajd.pages.dev was first observed on March 26, 2026 and is currently active. Automated scans and manual analysis have classified the site as a Bridge Scam targeting users of the SatoshiVM testnet. The page title “Bridge to SatoshiVM Testnet” is displayed to lure victims into believing the site provides a legitimate cross‑chain bridge service.

Infrastructure analysis shows the domain is hosted on Cloudflare’s network, resolving to IP address 188.114.96.3, which is geolocated to Canada and owned by Cloudflare, Inc. The authoritative nameservers are irena.ns.cloudflare.com and oswald.ns.cloudflare.com. The site serves over HTTPS with a certificate issued by Google Trust Services under the WE1 root, indicating a valid TLS chain but not validating the site's intent.

Reputation services flag the domain heavily. VirusTotal reports that 15 out of 95 scanned security vendors have identified the domain as malicious, and Gridinsoft assigns a trust score of 0 out of 100. The domain appears on two public blocklists, specifically PhishDestroy and ScamSniffer, both of which label it as a Bridge Scam. These indicators, combined with the high‑risk rating, suggest an active phishing campaign.

Defenders should add bridge-satoshivm-ajd.pages.dev to URL filtering and DNS block lists, enforce TLS inspection to capture the underlying HTTP payload, and monitor for any traffic to the 188.114.96.3 endpoint. User education campaigns should warn users that no legitimate SatoshiVM bridge operates under a pages.dev subdomain, and any requests for testnet token transfers should be treated as suspicious.