Cerca i domini monitorati ed esamina le prove archiviate, i rilevamenti e gli ultimi dati relativi alla disponibilità osservata.
193,455
Totale monitorato
193,452
VT rilevato
85,611
Ultima visualizzazione: attivo
99,033
Non disponibile all'ultimo controllo
1
VT In attesa di conferma
How This Attack Works
Unlike wallet-connect drainers that steal through smart contract approvals, seed phrase phishing captures the master key to your entire wallet — giving attackers complete and permanent control.
STEP 1
Impersonate Wallet Provider
Attackers create convincing clones of MetaMask, Ledger In diretta, Trust Wallet, or Phantom interfaces, often with "Support" or "Verify" branding to imply urgency.
STEP 2
Create Urgency
Users are told their wallet is "at risk," "needs verification," "requires migration," or that they need to "sync" their wallet. Fear drives immediate action without careful thinking.
STEP 3
Display Fake Recovery Form
The site shows a form with 12 or 24 input fields for seed words, styled identically to the real wallet's recovery interface. Some even validate word lists to appear legitimate.
STEP 4
Instant Total Drain
The moment all words are submitted, automated bots import the seed into a wallet, scan all chains (ETH, BSC, Polygon, Solana, etc.), and sweep all assets within seconds. The loss is total and permanent.
Technical Analysis
Seed phrase phishing sites are technically simple but devastatingly effective. The frontend is a static HTML page with 12-24 text input fields. Many implement BIP-39 word list validation (checking each word against the 2,048 valid seed words) to appear authentic.
Backend: entered phrases are sent via POST to an attacker-controlled server, often forwarded to Telegram bots for instant notification. Automated drainer scripts then import the seed using ethers.js or web3.js, derive all HD wallet paths (m/44'/60'/0'/0/x for Ethereum, m/44'/501'/0'/0' for Solana, etc.), check balances across chains, and sweep everything.
The entire drain process takes 5-30 seconds from phrase submission to complete asset theft. Some sophisticated operations even front-run pending transactions if the victim tries to move funds.
Backend: entered phrases are sent via POST to an attacker-controlled server, often forwarded to Telegram bots for instant notification. Automated drainer scripts then import the seed using ethers.js or web3.js, derive all HD wallet paths (m/44'/60'/0'/0/x for Ethereum, m/44'/501'/0'/0' for Solana, etc.), check balances across chains, and sweep everything.
The entire drain process takes 5-30 seconds from phrase submission to complete asset theft. Some sophisticated operations even front-run pending transactions if the victim tries to move funds.
Real Cases
MetaMask Support Scam (2024)
Thousands of victims stolen
Fake MetaMask support sites running Google Ads for "MetaMask help" and "MetaMask login" keywords. Users seeking help were directed to enter their seed phrase for "wallet recovery."
Ledger Data Breach Fallout (2023-2024)
$10M+ stolen stolen
After Ledger's customer database leak, attackers sent physical mail and phishing emails to verified Ledger owners, directing them to fake "security update" sites requesting seed phrases.
Trust Wallet Migration Scam (2024)
Ongoing stolen
Fake Trust Wallet "migration" sites claiming users must re-enter their seed phrase to migrate to a "new version." Promoted via fake app store reviews and Telegram groups.
How to Detect
ANY website asking for your seed phrase — no legitimate service will EVER request this
Fake "wallet verification," "security check," or "account sync" prompts
Input form with 12 or 24 empty fields for words — this is ALWAYS a scam outside of initial wallet setup
Urgency messaging: "Your wallet will be locked," "Funds at risk," "Verify within 24 hours"
URLs mimicking wallet providers: metamask-support.com, ledger-verify.io, trustwallet-sync.app
How to Protect Yourself
1
NEVER enter your seed phrase on any website — the ONLY time you type it is during initial wallet recovery in the official app
2
Store your seed phrase offline (paper, metal plate) — never in photos, notes apps, or cloud storage
3
Official wallet apps will never ask for your seed phrase through a website
4
If someone asks for your seed phrase for any reason (support, verification, airdrop) — it is 100% a scam
5
Utilizza un portafoglio hardware where the seed phrase is entered only on the physical device
Frequently Asked Questions
Data sourced from PhishDestroy threat intelligence database — 19 domains tracked for this threat type
Phishing della frase di seed 19 domains
phantomsecure.net
seedphrasefinder.xyz
forprojectwork2021.github.io
metamask.io-backupdevice.com
how-to-restore-trustwallet.blogspot.com
getting-started-ledgr-easily.pages.dev
ledgr-comstart-eu.pages.dev
ledgrre-com.pages.dev
phantom-wallet-support.blogspot.com
mmwalletsecurity.gt.tc
recoveryassaetmgmt.icu
phanthom.net
ledger-hardware-wallet-recovery.com
cold-wallet.org
ismyseedphrasesafe.com
satoshi-savers.com
seedphrasedrainer.pages.dev
xellox-website.pages.dev
Pipeline di risposta alle minacce
Come vengono verificati tutti i domini presenti in questo hub e come vengono neutralizzate le minacce confermate. Visualizzazione completa della pipeline →
Controlli relativi alle informazioni sulle minacce— ogni dominio viene analizzato e sottoposto a verifica incrociata rispetto a:
urlscan.ioScreenshot · DOM · HTTPVirusTotal90+ AV enginesGoogle Safe BrowsingTransparency RelazioneCloudflare RadarDNS · certs · categoriesAlienVault OTXThreat-intel pulsesWayback MachineHistorical evidenceabuse.ch ThreatFoxIOC correlationcrt.shCertificate TransparencyDNS Sicurezza FiltersQuad9 · AdGuard · CleanBrowsingWeb-ControllaFull surface scan
crt.shSincronizzazione globale dei fornitori— i rilevamenti confermati vengono trasmessi a 29 partner:
GoogleSafe BrowsingGoogleWeb Risk APIMicrosoftSmartScreenVirusTotalDetection feedCloudflareRadar / 1.1.1.1YandexSafe BrowsingURLScan.ioPublic scanESETWebGuardBitdefenderThreat exchangeNortonSafe WebSymantecRecensione del sitoAviraCloud detectionAvast / AVGWeb ShieldKasperskyOpenTIPDr.WebOnline scannerNetcraftRimozione APIPhishTankVerified voteAPWG eCXBulk feedPhishStatsOpen feedPhish.RelazioneHosting abuseSpamhausDBL feedPolySwarmMarketplaceCheckPhishBolster scanQutteraMalware scanURLquerySandboxCriminal IPAsset intelCRDFThreat CenterScamadviserTrust scoreMyWOTWeb of Trust