Back to Crypto Wallet Recovery Phrase Theft Scam Crypto Wallet / Exchange Impersonation

This is a version of Crypto Wallet Recovery Phrase Theft Scam in Crypto Wallet / Exchange Impersonation.

Fake Sunflower Land wallet connect window that asks for your recovery phrase

A page titled "Sunflower Land" shows a black window that says "This session is secured and encrypted with end-to-end encryption", with a large box labelled "Enter your 12/24 mnemonic word or private key" and a "Connect Wallet" button. Anything typed in the box is sent by a form service to an email inbox run by the people behind the page. It was first observed in Indonesia on November 2, 2026, at sunflower-land.botsfixs.workers[.]dev, a free Cloudflare Workers address that does not belong to Sunflower Land.

Fake Sunflower Land wallet connect window that asks for your recovery phrase | Screenshot

What’s different in this version

These traits set this message apart from the usual pattern.

  1. The lure is the name Sunflower Land rather than a wallet brand. The address starts with "sunflower-land" and sits under "botsfixs", which suggests a fix or support service.

  2. There is no other page content. The page goes straight to a window asking for the wallet's 12 or 24 recovery words or its private key, with a line about end-to-end encryption to make it feel safe.

  3. The page does not need its own server. Its form posts to a free form-to-email service, which forwards the recovery words to an email inbox.

  4. The page code says it was copied from another wallet page on a free Cloudflare Pages address, so the same page is being reused under new names.

  5. The page is on a free Cloudflare Workers address. How the link reached the person who found it was not recorded.

Other variations of this scam

Other reported versions of this scam.

Related scams

Other patterns in the same category, or that share a brand with this report.

How this scam works

  1. 1

    Step 1: You find or are sent a site that promises to keep your crypto safe, move it to a new system or fix a problem with your wallet.

  2. 2

    Step 2: The site looks like a large finance platform, with big user numbers, award badges and pop-ups saying other people just received large payouts.

  3. 3

    Step 3: You are asked to pick your wallet and connect it. The connection fails, and the site asks you to back up or link the wallet manually.

  4. 4

    Step 4: The manual option asks for your recovery phrase, private key, or keystore file and password.

  5. 5

    Step 5: What you type goes to the people running the site, not to your wallet provider, and they can use it to empty the wallet.

✓ Do this

  • Keep your recovery phrase offline and only enter it in your own wallet app when you are restoring that wallet yourself.
  • Get wallet apps only from the wallet maker's official website or the official app store.
  • If you typed your recovery phrase or private key into a website, move any remaining funds to a new wallet with a new recovery phrase from a device you trust.
  • Report the site to the hosting provider and to your national fraud reporting service.

✗ Avoid this

  • Do not type your recovery phrase, private key or keystore file into any website, form or chat.
  • Do not trust a site because a wallet connection failed and it now offers a manual backup.
  • Do not trust a site because it shows payout pop-ups, user counts or awards.

Verbatim excerpts from the scam

Exact lines from emails or messages—searchable text so you can compare wording.

  1. 1 Excerpt 1
    This session is secured and encrypted with end-to-end encryption
  2. 2 Excerpt 2
    Enter your 12/24 mnemonic word or private key
  3. 3 Excerpt 3
    Connect Wallet