Known malicious kitcriticalphishing
Fake wallet-recovery page that asks for the 12- or 24-word recovery phrase and posts it to its own server
family: wallet-seed-collect-kit-2026-11
Short link:scanmalware.com/h/341
A single-page 'wallet recovery' screen, seen styled as BlueWallet, says the wallet's recovery phrase must be re-verified 'for your funds' safety' and asks for all 12 or 24 words in the correct order, with a Paste button that reads the clipboard. The button only unlocks at exactly 12 or 24 words. On submit the page shows 'Verifying signature...', sends the phrase together with the visitor's browser, language, screen size and time zone to /collect on the same site, and then claims the wallet is syncing. Whoever holds the phrase can empty the wallet. Sighted at bluewallets[.]at in November 2026.
Anchors
Hunting ruleWallet_Seed_Phrase_Collect_Kit
SMQL queryrun
domain:bluewallets.at OR title:"BlueWallet — Wallet Recovery"Provenance
Added: 2026-11-03 13:30
Matches the page's own code wherever it is served, whatever the brand or the domain: the recovery-phrase text box with the id 'seed', the word-count check that unlocks the button at 12 or 24 words, and the request that posts the phrase with the screen size and time zone. The search adds the known domain and the page's title. The server also answered for heroku[.]digital, dailyblockreport[.]com and meridianfoliots[.]com, none of which showed this page, and it hosted an exposed ARTEX penetration-testing console. Not the same kit as the fake wallet-extension 'update' window or the MetaMask 'restore your wallet' pages on public storage buckets.