Fake claim sites and lookalike domains
How phishing domains imitate real projects with typos, extra words, other extensions and lookalike characters, and how to make sure you are on the real site.
On this page
A drainer site's main weapon is a domain that is close enough to fool you at a glance. Learn the patterns and you will spot most of them.
The common tricks
| Trick | Real | Fake example |
|---|---|---|
| Extra word | example.xyz |
example-claim.xyz, claim-example.xyz |
| Different extension | example.xyz |
example.io, example.app, example.org |
| Typo or swap | example.xyz |
exmaple.xyz, examp1e.xyz |
| Subdomain trick | app.example.xyz |
app.example.xyz.claims-portal.com |
| Lookalike characters | example.xyz |
Cyrillic е or а in place of Latin letters (shown in raw form as xn--...) |
| Free hosting | example.xyz |
example-airdrop.vercel.app, example.gitbook.io copies |
The subdomain trick catches many people. To find who really owns a web address, look at the part just before the first single / and read it from the right: the last two labels (sometimes three, as in .co.uk) are the domain. In app.example.xyz.claims-portal.com, the real domain is claims-portal.com, not example.xyz.
Why "it has HTTPS" means nothing
The padlock only means the connection is encrypted between you and whoever owns that domain. Free certificates are issued in minutes to anyone, including scammers. A padlock does not mean the site is safe or genuine.
How to always reach the real site
- Bookmark official sites the first time you visit them from a source you trust, and use the bookmark from then on.
- Do not use search ads for crypto sites. Scroll past sponsored results or, better, use your bookmark.
- Cross-check the domain in more than one official place: the project's verified social profile, documentation, GitHub organisation and announcements.
- Watch your password manager. If it does not offer to autofill on a site where you have an account, the domain is probably not the one you saved. See password managers.
- Be suspicious of new domains. Many drainer domains are only days old. Domain lookup tools can show the registration date.
Wallet and browser warnings
Several wallets and browsers maintain blocklists of known phishing domains and show a full-page warning. Never click through such a warning to "continue anyway" on a crypto site. Note that blocklists also miss brand-new domains, so no warning does not mean safe.
Report it
If you find a fake site, reporting it to browser blocklists and the impersonated project helps protect others. See where to report scams.