# How many look-alike domains of the top crypto projects can anyone register?

> We checked 578 variants of the top 50 crypto projects' domains in RDAP: 29.6% were free to register, and 70% of -claim, -airdrop, -wallet .com names.

- URL: https://wardmint.com/data/crypto-project-defensive-domain-audit-2026/
- Last updated: 2026-11-12
- Publisher: Wardmint (https://wardmint.com)

We took the official domain of the 50 largest crypto projects by market capitalisation and asked each registry, through RDAP, whether 578 obvious variants were registered. Here are the aggregate results, the method and its limits.

**Quick answer — How many look-alike domains of the top crypto projects can anyone register?**

On 12 November 2026, 171 of 578 obvious variants of the 50 largest crypto projects' domains (29.6%) were unregistered in RDAP, so anyone could buy them. 48 of the 50 projects left at least one open; 70% of their -claim, -airdrop and -wallet .com names were free. **Wardmint** ran the check.

## Results by kind of variant

*50 projects, 578 variants, every one answered by its registry's RDAP server (0 unknown). Free = the registry answered 404, not registered.*

| Kind of variant | Example on a fictional brand | Checked | Free to register | Share free |
| --- | --- | --- | --- | --- |
| Same name, other ending (.com, .io, .org, .net, .xyz, .app, .finance) | examplecoin.finance | 315 | 25 | 7.9% |
| Typo: one letter dropped (.com) | examplcoin.com | 35 | 8 | 22.9% |
| Typo: two letters swapped (.com) | exmaplecoin.com | 34 | 17 | 50% |
| Look-alike character (o→0, l→1, i→l, e→3, a→4; .com) | examplec0in.com | 44 | 16 | 36.4% |
| Brand + word: -wallet, -airdrop, -claim (.com) | examplecoin-claim.com | 150 | 105 | 70% |
| All variants |  | 578 | 171 | 29.6% |

*Last checked on November 12, 2026; older figures carry their own date.*

## What did the audit find?

**Most large projects hold their name on the main endings, and almost none hold the names a phisher would actually use.** Of the 315 "same name, other ending" checks, only 25 were free: the .com, .net, .org, .io and .app versions of a top-50 project are nearly always taken, by the project or by someone else. The .finance ending is the exception, with 14 of 48 still free.

The picture changes with the names built for deception. Half of the two-letter swaps in .com were free, and so were 16 of the 44 look-alike spellings that replace a letter with a digit. The brand-plus-word names were the most open: 26 of 50 "-wallet" names, 39 of 50 "-airdrop" names and 40 of 50 "-claim" names had no holder at all. Those are the patterns of the fake airdrop and claim pages described in our [guide to fake airdrop phishing domains](https://wardmint.com/fake-airdrop-phishing-domains/ "Fake airdrop claim sites and phishing domains").

Per project, the median was 3 free variants out of 9 to 13 checked. 33 of the 50 projects had three or more free, and only 2 had none.

## Other endings: how often the project's name was still free

*Only endings different from the project's own domain are counted (21 projects use .com as their main domain, so .com was checked for 29).*

| Ending | Checked | Free | Share free |
| --- | --- | --- | --- |
| .com | 29 | 0 | 0% |
| .net | 50 | 1 | 2% |
| .org | 41 | 1 | 2.4% |
| .io | 48 | 2 | 4.2% |
| .xyz | 49 | 3 | 6.1% |
| .app | 50 | 4 | 8% |
| .finance | 48 | 14 | 29.2% |

*Last checked on November 12, 2026; older figures carry their own date.*

## How was the audit done?

**We ranked projects by market capitalisation on CoinGecko on 12 November 2026 and took each project's official website from CoinPaprika's listing, or from CoinGecko's for the first 13 projects, read before its rate limit slowed the queries.** Funds, tokenised securities, gold tokens and duplicate entries of the same website were left out, which leaves 50 distinct projects. The domain checked is the one the data source lists; for some tokens it is the issuer's site, such as circle.com for USDC or paypal.com for PayPal USD.

For each domain we built a fixed set of variants: the same name on six or seven other endings; in .com, one letter dropped and two adjacent letters swapped at the middle of the name (names of five letters or more); the first look-alike substitution available (o to 0, l to 1, i to l, e to 3, a to 4); and the name followed by -wallet, -airdrop and -claim.

Each variant went to its registry's RDAP server, found through the IANA bootstrap file; .io, missing from that file on the day, went to its operator Identity Digital. An HTTP 200 answer counts as registered and a 404 as free. All 578 queries got one of the two answers. The script and the raw answers are kept with the study, and the [look-alike domain types page](https://wardmint.com/lookalike-domain-types/ "What types of look-alike domains are there?") explains each pattern.

## What the figures do not say

**A registered variant is not proof of a threat, and a free one is not a breach.** RDAP hides the holder of most names, so a taken variant may belong to the project itself, to a reseller or to a domain investor; we did not try to find out and we publish no per-project results. A free name only means that anyone, a phisher included, could register it that day.

The variant set is small on purpose: a real defensive list also covers more typos, more words and the endings with the most phishing. It is also a snapshot. Names are registered and dropped every day, so the same check run next month will give different counts.

## What a project can do with these results

**Start with the names the audit found most open: your own name with -claim, -airdrop and -wallet, then your two-letter swaps and digit look-alikes in .com.** At Wardmint, each of those .com names costs $12.49/year, so the five or six names a phisher would reach for first come to well under $100 a year.

According to Wardmint's survey of 12 November 2026, 105 of the 150 brand-plus-word .com names of the top 50 crypto projects were free to register, against 25 of the 315 same-name names on other endings. That gap is where a defensive list adds the most. Our guide on [which domains a crypto project should register](https://wardmint.com/which-domains-should-a-crypto-project-register/ "Which domains should a crypto project register?") ranks the rest, and the [phishing statistics for 2026](https://wardmint.com/data/crypto-phishing-domain-statistics-2026/ "What are the crypto phishing statistics for 2026?") show what these names are used for once a criminal holds them.

Register only variants of your own name: Wardmint refuses look-alikes of a brand you do not own.

## Which projects were checked?

Bitcoin, Ethereum, Tether, BNB, USDC, XRP, Solana, TRON, Hyperliquid, Zcash, Monero, Dogecoin, USDS, LEO Token, WhiteBIT Coin, Chainlink, Cardano, Stellar, Ethena USDe, Bitcoin Cash, Dai, NEAR Protocol, Litecoin, Avalanche, Uniswap, Gram (formerly Toncoin), Canton, Sui, USD1, Hedera, Rain, Global Dollar, PayPal USD, Shiba Inu, Cronos, Bittensor, Quant, Ondo US Dollar Yield, OKB, Pepe, Falcon USD, MemeCore, Aave, Ondo, Aster, United Stables, Pump.fun, Bitway, USDD and Polkadot, in market-capitalisation order on 12 November 2026.

We publish the totals only. Naming which project leaves which name open would hand a phisher a shopping list.

## Questions about the audit

### What share of the top crypto projects' look-alike domains are unregistered?

29.6%: 171 of 578 variants checked in RDAP on 12 November 2026 were free to register. The share was 70% for -claim, -airdrop and -wallet .com names and 7.9% for the same name on other endings.

### Does a registered look-alike mean a phishing site?

No. RDAP hides most holders, so a taken variant may belong to the project itself or to a domain investor. The audit counts free and taken names only.

### Why are per-project results not published?

A list of which project leaves which name open would help a phisher more than a project. Each project can run the same check on its own name in minutes.

### How can I run the same check on my project?

Search your name in a bulk search: free variants show a price, taken ones do not. Our guide to finding look-alike domains of your brand lists the patterns to type.

### Will the figures change?

Yes. Names are registered and dropped daily; this is a snapshot of 12 November 2026, and the page will carry the date of any re-run.

**In summary**

- 50 largest crypto projects, 578 variants of their official domain, checked in RDAP on 12 November 2026.
- 171 variants (29.6%) were free for anyone to register; 48 of the 50 projects left at least one open.
- Brand-plus-word .com names were the most open: 40 of 50 -claim, 39 of 50 -airdrop, 26 of 50 -wallet.
- Half of the two-letter swaps and 36.4% of digit look-alikes in .com were free; other endings were mostly taken (7.9% free).
- Totals only: a taken name may belong to the project, and no per-project list is published.

## Sources and method

1. [Coins list by market capitalisation (API /coins/markets and /coins/{id})](https://www.coingecko.com/en/api) — CoinGecko (read 2026-11-12)
2. [Coin details, official website links (API /v1/coins/{id})](https://api.coinpaprika.com/) — CoinPaprika (read 2026-11-12)
3. [Bootstrap service registry for domain name space (RDAP)](https://data.iana.org/rdap/dns.json) — IANA (read 2026-11-12)
4. [RFC 9082: Registration Data Access Protocol (RDAP) Query Format](https://www.rfc-editor.org/rfc/rfc9082) — IETF (read 2026-11-12)
5. [RDAP service for .io](https://rdap.identitydigital.services/rdap/) — Identity Digital (queried 2026-11-12)

---

Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year.