Observed arrival · 2026-09-27
A MetaMask lookalike runs a recovery-phrase trap
Credibility concern recorded. The source reference remains available for verification and correction.
The page stages a new-device wallet alert, then asks visitors for their 12-word recovery phrase.
- For
- People evaluating a suspicious wallet-security page
- Worth noticing
- It asks about exchange and wallet connections before requesting all 12 recovery words.
Field notes
The flow begins with a claimed unfamiliar-device event and supplies a device, location, and timestamp before asking about exchange and wallet connections. Later screens say a phrase will be updated and show a claimed restoration result; the extracted text does not verify that any wallet action occurs. The observed metamask.monster domain resolves to metamask.homes, a mismatch worth noting when assessing the page.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
One card from the complete issue