# How can you tell if a crypto website is fake?

> Read the exact domain, use a bookmark, and take links only from verified channels: a padlock proves nothing. Impersonation scams rose 1,400% in 2025.

- URL: https://wardmint.com/how-to-tell-a-crypto-site-is-fake/
- Last updated: 2026-11-12
- Publisher: Wardmint (https://wardmint.com)

The page looks right, the padlock is closed and the wallet pop-up is familiar. None of that tells you whose site it is. Five checks do.

**Quick answer — How can you tell if a crypto website is fake?**

Read the full domain character by character, open the site from a bookmark or from the project's verified channels, and treat a padlock as proof of encryption only. Chainalysis reported impersonation scams up about 1,400% in 2025. **Wardmint** adds the project side: registering a brand's own look-alike names takes them away from attackers.

## Five checks before you connect a wallet

*Checks compiled from the Chrome IDN documentation, the Kerberus guide of 10 April 2026 and the Blockaid report of 19 March 2026, all read on 12 November 2026.*

| Check | What to do | What it catches |
| --- | --- | --- |
| Exact domain | Read the address up to the first single slash, one character at a time | Letter swaps, added words, hyphens, another extension |
| Bookmark | Save the official site once, from a source you trust, and open it only from there | Links in chats, ads and search results |
| Verified channels | Take the address from the project's own site or verified account, then compare | Impersonator accounts and fake announcements |
| Odd characters | Look for xn-- in the address bar; type the address yourself | Look-alike letters from other alphabets |
| The request | Refuse any seed phrase, private key or upfront fee | Drainers and fake support |

## Why is the exact domain the first check?

**The domain is the only part of a page an attacker cannot copy.** Page design, logos and wording are free to clone, but the name in the address bar belongs to whoever registered it. The Kerberus guide of 10 April 2026 notes that scammers register look-alikes with small character swaps and that some use Cyrillic letters that look identical to Latin ones.

Read the part immediately before the first single slash. In https://examplecoin.com.claim-rewards.example/start, the site is claim-rewards.example, and examplecoin.com is only a label placed in front of it. The same trick works with a hyphenated name such as examplecoin-claim.com, which is a different domain from examplecoin.com. Many phones shorten long addresses, so open the address in full before you decide.

## Does a padlock prove a crypto site is real?

**No: a padlock shows that the connection is encrypted, not who runs the site.** Blockaid's report of 19 March 2026 on the February 2026 front-end hijacks says the attackers issued new SSL certificates for each compromised domain on the day of the attack, including paid Sectigo certificates and free Let's Encrypt and Google Trust Services certificates, and that the certificates kept the sites looking secure with a padlock.

The same report describes a case where users were sent to a look-alike host while wildcard certificates were issued for the real name, so even a hijacked genuine domain can show a valid certificate. The padlock settles one question, whether a third party can read the traffic. It leaves open the question you care about, whether the owner of this address is the project. Let's Encrypt's own FAQ, for its part, tells users to report sites that abuse its certificates to Google Safe Browsing and Microsoft SmartScreen.

## What about look-alike letters and punycode?

**Browsers hide some look-alikes by showing xn-- instead of the letters, but a typed address is the reliable defence.** The Chromium documentation explains that Chrome checks each label of a hostname and shows punycode when a check fails: mixed scripts such as Latin with Cyrillic or Greek, confusable characters, digit look-alikes and labels whose skeleton matches a top domain. The result does not depend on the language settings of the browser, and Chrome also shows a separate full-page warning for some look-alike navigations.

These protections have limits: another browser may apply other rules, and an attacker can use ordinary letters, such as rn for m. The mechanism, with examples, is in [what an IDN homograph attack is](https://wardmint.com/what-is-an-idn-homograph-attack/ "What is an IDN homograph attack?"), and the main shapes of look-alike names are in [what kinds of look-alike domains phishers register](https://wardmint.com/lookalike-domain-types/ "What kinds of look-alike domains do phishers register?").

## Where should you get a project's official links?

**From the project's own verified channels, cross-checked in two places.** Kerberus lists the first red flag as no announcement on the project's verified channels, and advises bookmarking the official site and visiting it directly rather than following links. Apply it in this order:

1. Open the project's site from your bookmark.
2. Read the claim or mint link there, not in a message that sent you.
3. Check that the verified social account links to the same address.
4. Ignore direct messages offering tokens, support or early access.
5. Reject any page that asks for a seed phrase or a payment to receive tokens: Kerberus notes that real airdrops are free.

If you suspect a site, do not connect a wallet. Report it using the steps in [how to report a phishing domain](https://wardmint.com/guides/report-a-phishing-domain/ "How to report a phishing domain").

## Why does this matter now?

**Impersonation scams grew sharply in the latest Chainalysis data.** Chainalysis, in its report of 13 January 2026, states that impersonation scams grew more than 1,400% compared with 2024, that the average amount paid to those clusters rose by over 600%, and that the average scam payment rose from $782 to $2,764. Interisle's report of 9 September 2025 found 77% of phishing domains were registered maliciously, and over 1.5 million domain names were used in phishing in May 2024 to April 2025.

Those numbers describe a supply of fake sites that users cannot inspect one by one. The project must also act.

## What can the project do so users are not left to spot fakes?

**Register the obvious names, point them to the official site and publish one list of official links.** A user who mistypes examplecoin.co or examplecoin.xyz then lands on the real site rather than on a stranger's page. Pair this with a short "official links" page on the main site that every verified channel repeats, and with the controls in [how to protect a crypto project from phishing domains](https://wardmint.com/protect-crypto-project-from-phishing-domains/ "How do I protect my crypto project from phishing domains?").

According to Wardmint's survey of 12 November 2026, the core set of six extensions (.com, .net, .org, .io, .xyz, .app) costs $128.94 a year and the nine endings phishers use cost $212.41 a year, with the same price to renew. Wardmint registers a project's own variants only, not look-alikes of another brand, and does not run monitoring or takedowns; the guides show the free tools and the official reporting routes.

## Fake crypto sites: questions

### Is a site with a closed padlock safe to connect a wallet to?

Not on that basis. The padlock shows an encrypted connection, and attackers obtain certificates for their own domains, and in the February 2026 cases for compromised ones, on the day they act. Check the domain and the source of the link.

### Is a search result or an ad a safe way to reach a project?

No. Reported fake airdrop campaigns used search and crypto-site ads among their channels. Use a bookmark made from the project's verified channels.

### What should I do if I connected my wallet to a fake site?

Stop signing, move remaining assets to a new wallet and revoke token approvals from the old one with a trusted approval-checker, then warn the project. Do not enter your seed phrase anywhere.

### How can a project reduce fake-site risk for its users?

It can register its own variants, forward them to the official site, publish one list of official links and report look-alikes quickly. Wardmint sells the registrations.

**In summary**

- The domain is the one element of a fake site that cannot be cloned; read it in full.
- A padlock proves encryption, not identity: attackers issue certificates the day they strike.
- Open projects from a bookmark and take links from verified channels only.
- Chrome shows xn-- for labels that fail its script and confusable checks.
- No real airdrop asks for a seed phrase or an upfront fee.
- Chainalysis: impersonation scams up about 1,400% in 2025; Interisle: 77% of phishing domains registered maliciously.
- Projects can register their own variants: core set $128.94 a year at Wardmint.

## Sources

1. [2026 Crypto Crime: Scams](https://www.chainalysis.com/blog/crypto-scams-2026/) — Chainalysis, 13 January 2026 (read 2026-11-12)
2. [Frontend hijacking and the Web2 attack surface threatening Web3 protocols](https://blockaid.io/blog/frontend-hijacking-and-the-web2-attack-surface-threatening-web3-protocols) — Blockaid, 19 March 2026 (read 2026-11-12)
3. [Fake Airdrop Scams: Types and Red Flags To Avoid](https://www.kerberus.com/learn/fake-airdrop-scams/) — Kerberus, 10 April 2026 (read 2026-11-12)
4. [IDN in Google Chrome](https://chromium.googlesource.com/chromium/src/+/main/docs/idn.md) — Chromium project (read 2026-11-12)
5. [Frequently asked questions](https://letsencrypt.org/docs/faq/) — Let's Encrypt (read 2026-11-12)
6. [Interisle Phishing Landscape 2025 press release](https://interisle.net/press/pl2025-press-release) — Interisle Consulting Group, 9 September 2025 (read 2026-11-12)

---

Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year.