sparrowwallets[.]pages[.]dev

PhishDestroy identifies sparrowwallets.pages.dev as an active crypto drainer targeting cryptocurrency users under investigation since seed 0eba3b.

This domain employs advanced evasion techniques, currently flagged by zero of 95 VirusTotal vendors despite resolving to IP 188.114.97.3 via Cloudflare, Inc. Its SSL certificate is issued by Google Trust Services, suggesting a calculated effort to mimic legitimacy. While no detections exist on VirusTotal, the absence of flags does not equate to safety, as newer crypto drainers often bypass initial scans through dynamic infrastructure and obfuscated payloads.

The threat level remains under investigation due to limited historical telemetry and the domain's recent deployment cycle. However, indicators such as the use of a Google-validated SSL certificate and Cloudflare's proxy layer are classic hallmarks of nefarious infrastructure designed to evade detection and prolong operational lifespan. Users who have interacted with this domain—especially in the context of cryptocurrency transactions—are strongly advised to revoke any connected wallet permissions, transfer remaining assets to a cold wallet, and perform a full system scan using reputable cybersecurity tools. Additionally, network administrators should consider blocking this domain and its associated IP at the firewall level to prevent further propagation.