How do fake airdrop claim sites and phishing domains work?

What does a fake airdrop campaign look like?

It looks like an announcement from the project, a link, and a wallet pop-up that feels routine. The MalwareTips write-up of 23 April 2025 documents one campaign against a staking token. It spread through spam email, Discord messages, fake social profiles posing as project staff, search and crypto-site ads and Telegram groups, and told holders they qualified for a larger allocation. It used three domain shapes: a claims- prefix on .net, a project-airdrop name on .xyz and a project-rewards name on .org. The page copied the project's branding and walked the visitor through connect wallet, check eligibility, claim and lock tokens. After the wallet connected, a script requested token approvals in the background and moved the assets it could reach; no seed phrase was asked for.

The final step explains why the domain matters. The user is not hacked: the user signs, on a site that looks like the project, at an address that looks like the project's.

Why do drainers keep using new domains?

Because domains are cheap to rotate and blocklists need time to catch up. Check Point Research's report of 7 May 2025 on the Inferno Drainer describes more than 30,000 new victims between September 2024 and March 2025 and at least $9,000,000 in losses over six months, noting that the total may be higher. It lists a dozen landing domains imitating one community-verification service and says they rotated every few days, and it describes a separate airdrop lure for a political memecoin on its own look-alike domain.

The same report shows that the domain is only one link in the chain. In the Discord campaign it describes, attackers claimed expired vanity invite links of crypto projects, so users who had saved an old link joined the attacker's server and met a fake bot without the Verified App checkmark. A project that lets a vanity invite lapse, or lets a domain lapse, hands the attacker a trusted name. Keeping renewals running is covered in how to stop your domains from expiring.

Which names should a project register before an airdrop?

Register the exact name on the main extensions, then the claim, airdrop and rewards words on the endings phishers favour. Interisle's data for 1 May 2025 to 30 April 2026 counts 869,180 phishing domains under .com, 130,945 under .pro, 99,602 under .info, 93,987 under .xyz, 79,625 under .shop and 74,786 under .icu. Those extensions are all in Wardmint's catalogue.

A practical order for an airdrop:

1. The core set (.com, .net, .org, .io, .xyz, .app, $128.94 a year) for the exact name.
2. The words you will use in the announcement, such as claim, airdrop and rewards, joined to the project name on .com, .xyz and .org.
3. The endings phishers use (.xyz, .pro, .info, .shop, .online, .icu, .click, .live, .support, $212.41 a year) for the exact name.
4. The common typos of the name, found with the free tools in how to find look-alike domains of your brand.

The full timeline around a token event is in which domains to register before a token launch. Wardmint registers a project's own variants for that project, never look-alikes of another brand, and it does not sell .top, one of the ten extensions in Interisle's list.

How should a project warn users?

State in advance where the claim lives and where it does not. The Kerberus guide of 10 April 2026 lists the red flags users should check: no announcement on the project's verified channels, a request for a seed phrase or private key, an upfront payment to receive tokens, unrealistic amounts and unsolicited tokens in a wallet. It also advises bookmarking the official site and warns that look-alike domains use small character swaps and Cyrillic letters.

A project can turn that list into its own announcement:

• Publish one claim address, on a domain you own, before the event.
• Say that you will never ask for a seed phrase or a payment to receive tokens.
• Pin the same statement on every verified channel.
• Redirect every defensive name to the official page with forwarding, so a mistyped claim link lands on your site rather than a stranger's.
• Know the reporting route: how to report a phishing domain sets out the registrar, host and blocklist contacts.

Wardmint provides free URL forwarding and email forwarding from the client area and a no-email DNS template (null MX, SPF -all, DMARC p=reject) for unused names.

How many of the most abused extensions does Wardmint sell?

According to Wardmint's survey of 12 November 2026, 6 of the 10 extensions with the most phishing domains in Interisle's 2025-2026 data (.com, .pro, .info, .xyz, .shop and .icu) are in its catalogue of 29, and 4 (.top, .cn, .vip and .cc) are not. A defensive name registered by the project cannot be registered by a drainer operator.

Two citable sentences: a fake airdrop domain is a copy of the project name with a claim word added; the first defence is to own the obvious ones before the announcement. Wardmint does not claim that registering names ends the fraud, since phishing also uses platform subdomains and hijacked channels. Look-alikes built with foreign letters are explained in what an IDN homograph attack is.