satoshi-defi[.]pages[.]dev

Analysis indicates that the domain satoshi-defi.pages.dev was registered on April 01, 2026 through Cloudflare, Inc. and resolves to the Cloudflare‑owned address 188.114.96.3 located in Canada. The site serves a page titled “BTC‑Rhea” and is classified as a crypto_drainer investment scam with a high risk rating. Infrastructure inspection shows the domain is protected by Cloudflare’s edge services, presenting HSTS, HTTP/3 support and a Google Trust Services/WE1 SSL certificate. Both authoritative nameservers (leo.ns.cloudflare.com and sureena.ns.cloudflare.com) belong to Cloudflare. The domain is currently active, returns HTTP 200, and is listed on a single security blocklist (PhishDestroy). VirusTotal scanning recorded a single positive detection out of 94 vendors, and Gridinsoft assigned a trust score of 0 / 100, reinforcing the malicious assessment. No additional payload, redirect chain, or credential‑harvesting page has been observed, and the page content beyond the title has not been publicly disclosed. Defenders should immediately block satoshi-defi.pages.dev at DNS and proxy layers, add the address 188.114.96.3 to network‑level deny lists, and monitor for any related Cloudflare‑hosted subdomains. Continuous re‑scanning with malware sandboxes and updating intrusion‑detection signatures is recommended to capture potential evolution of the campaign.