webconnect-sparrow[.]pages[.]dev

This domain, webconnect-sparrow.pages.dev, is currently under investigation for brand impersonation targeting Bitcoin wallet users. Analysis indicates the site mimics the legitimate Sparrow Bitcoin Wallet interface, as evidenced by its page title, 'Sparrow Bitcoin Wallet - Sparrow Wallet.' The threat type involves credential harvesting and potential cryptocurrency theft, with the domain actively resolving to infrastructure associated with malicious activity. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on March 30, 2026, and resolves to the IP address 188.114.96.3, geolocated to Canada. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of both legitimate and malicious sites leveraging Cloudflare services. Despite its active status, the domain has not been flagged by any of the 95 vendors on VirusTotal as of the latest scan. However, it appears on one security blocklist, indicating preliminary detection by at least one threat intelligence source. The domain's creation date is unusually forward-dated, which may suggest an attempt to evade temporal-based detection mechanisms or could be an artifact of misconfigured registration data. Current risk assessment places this domain in an ambiguous state due to limited detection but clear indicators of brand impersonation. Users are advised to exercise extreme caution when interacting with this domain or any associated links. Organizations should consider blocking access to 188.114.96.3 and monitoring for connections to webconnect-sparrow.pages.dev in network logs. Individuals who may have entered credentials or wallet information on this site should immediately transfer assets to a new wallet, revoke any associated API keys, and monitor for unauthorized transactions. Security teams are encouraged to submit the domain for further analysis to improve detection coverage across threat intelligence platforms.