satoshidex-web[.]pages[.]dev

Analysis of the domain satoshidex-web.pages.dev indicates a confirmed brand-impersonation scam targeting Bitcoin users, currently active as of July 12, 2026. The domain was registered on March 29, 2026, through Cloudflare, Inc., and resolves to the IP address 188.114.97.3, hosted under Cloudflare's infrastructure in Canada. Infrastructure analysis reveals the use of Cloudflare nameservers (isla.ns.cloudflare.com and patryk.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1). The site employs React, HSTS, and HTTP/3 technologies, which are consistent with modern web applications but do not mitigate the malicious intent. The page title, 'SatoshiDEX: The World's First Bitcoin DEX,' explicitly impersonates the Bitcoin brand, a tactic aligned with the scam type classified as brand impersonation. Detection metrics corroborate this assessment: the domain is flagged by 12 of 94 security vendors on VirusTotal and appears on one security blocklist. Google Safe Browsing has categorized the domain under 'SOCIAL_ENGINEERING,' further validating its fraudulent nature. Gridinsoft assigns a trust score of 0/100, reflecting a high-risk classification. The domain remains unblocked by most major security platforms but is currently blocked by PhishDestroy. Defenders should prioritize blocking access to this domain at the network level, particularly in environments where cryptocurrency-related activities are conducted. Given the use of Cloudflare's infrastructure, takedown efforts may require coordination with the registrar. The exact content and functionality of the site have not been analyzed, but the combination of brand impersonation, social engineering flags, and detection by multiple security vendors confirms its malicious intent. Continuous monitoring is recommended, as the domain may evolve or be repurposed for additional fraudulent activities.