The reported site habbouusivuosi[.]com exhibits multiple high-confidence indicators of malicious intent.
Credential/Seed Phrase Phishing
The most critical observation is that the site explicitly requests the user's
12-word recovery phrase (seed phrase). Under no legitimate circumstances will a decentralized application (dApp) or service require your seed phrase to "connect" or receive rewards. This is a direct violation of standard security practices defined in NIST SP 800-63B.
Social Engineering Lure
The attacker uses a "free gift" or "reward" valued at approximately 45 EUR to create a sense of urgency. This matches the "Reward/Prize" lure category frequently documented by SANS.
Wallet Draining via Approvals
Even without a seed phrase, simply "connecting" a wallet and signing a transaction can lead to total asset loss. Attackers use malicious setApprovalForAll or permit signatures to grant themselves permission to transfer your tokens/NFTs at a later time.
Domain Indicators
The domain habbouusivuosi[.]com is newly registered, a common indicator of a "disposable" phishing infrastructure designed to evade reputation-based filters.
Recommendation / Remediation
If you or anyone you know has interacted with this site, perform the following steps immediately.
Cease All Interaction
Close the browser tab and do not revisit the site.
Asset Triage (If Seed Phrase was Entered)
If you provided your 12-word phrase,
the wallet is compromised. You must immediately create a completely new wallet (with a new seed phrase) and attempt to move any remaining assets to the new address. Do not use the old wallet again.
Revoke Approvals (If Wallet was Connected)
If you connected your wallet but did not give the seed phrase, you may have signed a malicious approval. Use a trusted tool like revoke[.]cash to check for and revoke any permissions granted to unknown contracts.
Disconnect Site
In your MetaMask settings, go to "Connected Sites" and manually remove any entry related to the suspicious domain.
Browser Cleanup
Clear your browser cache and cookies to ensure no session-based tracking remains.
References
NIST SP 800-63B
(Digital Identity Guidelines)
SANS Security Awareness
Phishing
MITRE ATT&CK
T1566 (Phishing)
T1566.002 (Spearphishing Link)
This analysis reflects current threat intelligence as of January 26, 2026. 
