satoshi-dex-ai[.]pages[.]dev

Analysis of the domain satoshi-dex-ai.pages.dev indicates a high-risk brand impersonation threat targeting Bitcoin users. The domain, registered on March 31, 2026, through Cloudflare, Inc., resolves to the IP address 172.66.46.223 and is currently active. Infrastructure analysis reveals it is hosted under Google Trust Services SSL certification, a common feature in both legitimate and malicious sites, which does not inherently confirm safety. The page title, 'SatoshiDEX: The World's First Bitcoin DEX,' explicitly claims affiliation with Bitcoin decentralized exchange services, aligning with the reported brand impersonation threat type. Security vendors have flagged this domain on multiple blocklists, including ScamSniffer, PhishDestroy, and Enkrypt. Google Safe Browsing classifies the domain under 'SOCIAL_ENGINEERING,' a designation typically applied to sites attempting to deceive users into performing harmful actions. Twelve of ninety-five security vendors on VirusTotal have detected malicious indicators associated with this domain, though the absence of detections from the remaining vendors does not confirm safety. The domain appears on three independent security blocklists, further supporting its classification as a high-risk entity. The domain's trust scores from Gridinsoft (0/100) and Scamadviser (11/100) reflect near-universal skepticism regarding its legitimacy. While the exact content and functionality of the site remain unanalyzed, the combination of brand impersonation, social engineering flags, and widespread security vendor detections provides strong evidence of malicious intent. Defenders should treat this domain as a confirmed threat, block access at the network level, and monitor for related infrastructure or phishing campaigns targeting cryptocurrency users. No evidence suggests this is a legitimate service, and users should avoid interaction with the domain.