connected-bluewalllet-bitcoin[.]pages[.]dev

PhishDestroy identifies connected-bluewalllet-bitcoin.pages.dev as an active brand impersonation domain specifically targeting Bitcoin users by mimicking the legitimate BlueWallet Bitcoin wallet service. This site lures victims with a fraudulent guide promising setup, usage, and troubleshooting advice for BlueWallet, a popular open-source Bitcoin wallet application. Upon investigation, the domain resolves to IP 172.66.47.203 and is registered through Cloudflare, Inc., using a Google Trust Services SSL certificate to appear legitimate. The page title deliberately mirrors official BlueWallet branding to deceive users seeking support resources. This domain poses a direct financial threat by redirecting users to malicious download links or phishing forms designed to steal Bitcoin wallet credentials, private keys, or mnemonic phrases. Evidence shows this threat remains undetected by VirusTotal with 0/95 security engines flagging it despite clear impersonation tactics. The domain is currently active and continues to operate without blocklist intervention, indicating a persistent risk to unsuspecting users. The use of Cloudflare’s infrastructure and Google Trust Services SSL certificate further enhances its credibility, making it harder for users to distinguish from legitimate sources. Users who may have visited connected-bluewalllet-bitcoin.pages.dev should immediately check their devices for unauthorized Bitcoin wallet applications, review transaction history for suspicious activity, and reset wallet passwords if credentials were entered. Avoid downloading any software or entering sensitive information on this domain. If Bitcoin wallet credentials were exposed, transfer remaining funds to a new wallet immediately and consider the device potentially compromised. Report this domain to your Bitcoin wallet provider and consider blacklisting it through your network or browser settings to prevent future exposure.