# What should you do when a phishing site impersonates your project?

> First-hour checklist when a phishing site impersonates your crypto project: confirm, warn users, report in parallel, and rotate access.

- URL: https://wardmint.com/guides/handle-a-domain-impersonation-incident/
- Last updated: 2026-11-12
- Publisher: Wardmint (https://wardmint.com)

The first hour decides how many users sign the wrong request. This checklist separates a look-alike site from a hijack of your own domain, then orders the warnings, the reports and the follow-up.

**Quick answer — What should you do when a phishing site impersonates your project?**

When a phishing site impersonates your project, first check whether your own domain still resolves correctly, then warn users from verified channels with your real address, report the site to its registrar and host in parallel, and rotate any access an attacker could hold. Chainalysis counted impersonation scams up about 1,400% in 2025. **Wardmint** acts within 24 hours of a well-documented report.

## The first hour, minute by minute

*A working schedule, not a guarantee of any outcome.*

| Window | Action | Owner |
| --- | --- | --- |
| 0 to 10 minutes | Confirm the fake, check your own DNS, name an incident lead | Security lead |
| 10 to 25 minutes | Post a warning on every verified channel with the real address; pause any signing campaign | Community lead |
| 25 to 40 minutes | Send the evidence pack to registrar and host; flag the URL on warning lists | Security lead |
| 40 to 60 minutes | Check registrar account access, rotate passwords and 2FA, review DNS records | Ops lead |
| After the first hour | Track reports, update users, decide on a UDRP complaint | Incident lead |

## The first-hour checklist

1. **Separate a look-alike from a hijack** — Run the DNS check below. A look-alike is a different domain; users who typed or clicked wrongly landed there. A hijack means your own domain now points elsewhere, and the case is an emergency at your registrar.
2. **Name one incident lead** — One person owns the timeline, the evidence folder and every outbound message. Others execute; they do not freelance.
3. **Warn users from channels they trust** — Post the real address on your site banner, social accounts, community server and wallet-integration channels. Say plainly: never sign a request from any other address. Write the fake address defanged, such as example[.]com, so nobody clicks it.
4. **Start the reports in parallel** — Registrar and host first, then Safe Browsing, Netcraft, Chainabuse and wallet blocklists. The report guide has the RDAP commands.
5. **Lock down your own access** — Review the registrar account, DNS provider and hosting logins. Rotate passwords, replace SMS 2FA with a hardware key, and check the DNS records line by line. See how to protect your registrar account from takeover.
6. **Help users who already signed** — Tell them to move remaining funds to a new wallet, to review and revoke token approvals with a block-explorer approval checker, and to send you the transaction hash. Do not promise a refund in the first message.

*Step 1: is your own domain still pointing where it should?*

```bash
dig +short NS yourdomain.com
dig +short A yourdomain.com
dig +short TXT yourdomain.com
curl -sL https://rdap.org/domain/yourdomain.com | jq '{status: .status, nameservers: [.nameservers[].ldhName], changed: [.events[] | select(.eventAction=="last changed") | .eventDate]}'

# compare with the values you recorded in your runbook; a changed nameserver or a new "last changed" date you did not make is a hijack
```

## How do you tell a look-alike site from a hijack of your own domain?

**If your domain still resolves to your servers and its nameservers are yours, the fake lives on another domain.** The check takes under a minute with the commands above. A look-alike means the attacker owns a different domain and relies on users mistyping, clicking an ad or following a link.

A hijack is different. On 12 May 2025 Curve Finance's domain was redirected at the registrar level at about 20:55 UTC; the team found it at 21:20 UTC and told users to use curve.finance as an interim address, and said that contracts and user data were not affected. On the evening of 30 October 2026, domains of about a dozen DeFi front ends registered with Name.com were redirected to a drainer kit, and The Block reported that ten domains were suspended at 8:32 a.m. Eastern Time the next morning. In a hijack, call your registrar before anything else.

## What should the warning to users say?

**A good warning gives the real address, says what to refuse, and names no one as guilty.** Keep it to four lines: what happened, the one official address, the instruction to reject any signature request from another address, and the time of the next update.

Do not link the fake site. Do not guess at losses. Curve's May 2025 notice is a model of the form: it said what was redirected, which address to use, and that contracts were untouched. Pin the notice on every channel and edit it in place when facts change, with the time of each edit. The longer-term step is a [defensive set of your own variants](https://wardmint.com/defensive-domain-registration/ "What is defensive domain registration?") so that the obvious fakes are not for sale to an attacker.

## What do you do about the reports and the evidence?

**Send one evidence pack to every recipient the same hour.** The pack holds the URL, dated screenshots, the signature request, receiving wallet addresses and the RDAP output. The full order of contacts is in [how to take down a phishing site copying your dApp](https://wardmint.com/guides/take-down-a-phishing-site/ "How to take down a phishing site copying your dApp").

Keep a log of every report with its time, recipient and reference number. A later UDRP complaint, an ICANN Compliance complaint or a police report starts from that log. Drainer losses are large: ScamSniffer counted 106,106 victims and USD 83.85 million in wallet-drainer losses on EVM chains in 2025, so a clean log helps users who file their own reports.

## How much does preparation change the first hour?

**A written runbook saves the minutes you cannot spare.** According to Wardmint's survey of 12 November 2026, its research file holds four hijack entries with a primary source since July 2024: the Squarespace wave (July 2024), Curve Finance (May 2025), a five-project cluster (February 2026) and Name.com customers (October 2026). Each source ties the attack to the domain, registrar or DNS layer rather than to smart contracts, although the October 2026 cause is disputed between Name.com and Vercel. Write down, before you need it: the registrar login owner, where 2FA keys are kept, the DNS records you expect, and the contact for each channel.

For hardening before an incident, see [how to secure your domain against DNS hijacking](https://wardmint.com/guides/secure-domain-against-dns-hijacking/ "How to secure your domain against DNS hijacking"). Support at Wardmint: email replies within 12 hours, 7 days a week, including help with DNSSEC, CAA records and abuse reports.

## Questions about impersonation incidents

### Should I take my real site offline during an incident?

Only if your own domain is hijacked or compromised. For a look-alike on another domain, keep your site up and make the real address more visible.

### Should I announce the incident publicly?

Yes, once you have confirmed it. Users sign the fake request in the minutes before they hear of it, so a short factual notice from verified channels does more good than a complete report written later.

### Can users get their funds back?

Do not promise it. Tell users how to protect remaining funds and ask them to share transaction hashes; recovery depends on the chain, the drainer and any law enforcement action.

### How soon will the registrar act on my report?

No timeline binds all registrars. ICANN has required accredited registrars to act promptly on actionable evidence of phishing since 5 April 2024. At Wardmint, action comes within 24 hours of a well-documented report.

**In summary**

- Check your own DNS first: a look-alike and a hijack need different calls.
- Warn users from verified channels with the real address and no live link to the fake.
- Send registrar and host reports in parallel with one evidence pack.
- Rotate registrar, DNS and hosting access and move to hardware 2FA.
- Chainalysis counted impersonation scams up about 1,400% in 2025.
- ScamSniffer counted USD 83.85 million lost to wallet drainers on EVM chains in 2025.
- Wardmint acts within 24 hours of a well-documented report.

## Sources

1. [Curve domain incident](https://news.curve.finance/curve-domain-incident/) — Curve Finance (read 2026-11-12)
2. [Hackers hijack a dozen DeFi websites, all registered with Name.com](https://theblock.co/news/defi/2026-10-31-hackers-hijack-a-dozen-defi-websites-all-registered-with-name-com-and-steal-about-138000-432251) — The Block (read 2026-11-12)
3. [Crypto scams 2026: Chainalysis report](https://www.chainalysis.com/blog/crypto-scams-2026/) — Chainalysis (read 2026-11-12)
4. [ScamSniffer 2025 report: crypto phishing losses fall 83% to $84 million](https://drops.scamsniffer.io/scam-sniffer-2025-crypto-phishing-losses-fall-83-to-84-million/) — ScamSniffer (read 2026-11-12)
5. [Front-end hijacking and the Web2 attack surface](https://blockaid.io/blog/frontend-hijacking-and-the-web2-attack-surface-threatening-web3-protocols) — Blockaid (read 2026-11-12)
6. [Researchers: weak security defaults enabled Squarespace domains hijacks](https://krebsonsecurity.com/2024/07/researchers-weak-security-defaults-enabled-squarespace-domains-hijacks/) — Krebs on Security (read 2026-11-12)
7. [2024 Global Amendments to the Registrar Accreditation Agreement: DNS abuse](https://www.icann.org/resources/pages/global-amendment-2024-en) — ICANN (read 2026-11-12)

---

Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year.