# Wardmint — full content for language models > Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. Source: https://wardmint.com/ · Generated: 2026-11-12 # Own your name before a phisher does. > Wardmint registers a crypto project's own variants: core set of 6 endings $128.94 a year, bulk search of 50, paid in crypto, no KYC. - URL: https://wardmint.com/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) Register your project's other endings, typos and look-alikes in one bulk search, pay from your treasury in crypto, and make every variant forward to your site and send no email. No KYC: one verified email per domain. Search a domain name: https://wardmint.com/app/domains/?q=yourproject Popular extensions: .com ($12.49), .io ($59.49), .xyz ($14.99), .finance ($60.49) **examplecoin — defensive set** - examplecoin.com (Main site): Your site, $12.49/year - examplecoin.io (Other ending): Forwards to examplecoin.com, $59.49/year - examplecoin.xyz (Other ending): Forwards to examplecoin.com, $14.99/year - examplecoin.finance (Other ending): Forwards to examplecoin.com, $60.49/year - examplecoin.app (Other ending): Forwards to examplecoin.com, $15.99/year - exampelcoin.com (Typo): Sends no email, $12.49/year - example-coin.com (Hyphen): Sends no email, $12.49/year - examplec0in.com (Look-alike): Sends no email, $12.49/year - examplecoin-app.com (Brand + word): Sends no email, $12.49/year 9 domains · $213.41/year A fictional project. Prices are ours, per year, the same at every renewal. **Quick answer — What does Wardmint do for a crypto project?** **Wardmint** registers the defensive domains a crypto project needs: its own name on the endings phishers use, and its own typo and look-alike variants. A core set of six endings costs $128.94 a year, found in one bulk search of up to 50 names and paid in crypto with no KYC, one verified email per domain. - **Your own variants, never someone else's** - **Bulk search of 50 names** - **Treasury or multisig pays in crypto** - **No KYC: one verified email** ## Why does a crypto project need defensive domains? **Because the easiest attack on your users is a domain that looks like yours.** A drainer page on examplecoin-claim.com or examplec0in.com costs a phisher one registration, and it needs no exploit: your users type a wallet signature into it themselves. Chainalysis estimated that crypto scams received at least $14 billion on-chain in 2025 and that impersonation scams grew about 1,400% in a year. Interisle Consulting found that 77% of phishing domains in its 2025 study were registered by the criminals themselves, not hacked from someone else. You cannot register every possible variant, and you should not try. You can take the ones that matter most: your name on the endings people trust (.com, .io, .app), the finance words a phisher would pick (.finance, .exchange), the endings with the most phishing in Interisle's data, and the two or three typos and look-alikes of your name that are easiest to miss. The guide on [which domains a crypto project should register](https://wardmint.com/which-domains-should-a-crypto-project-register/ "Which domains should a crypto project register?") ranks them, and the [look-alike types page](https://wardmint.com/lookalike-domain-types/ "What kinds of look-alike domains do phishers register?") shows each pattern on a fictional brand. According to Wardmint's survey of 12 November 2026, the 29 extensions we sell cost a median 33% less per year than Namecheap's regular renewal price for the same extension, so a defensive set renews without a jump. ## What does a defensive set cost per year? Suggested sets at our prices, one price every year. They are not bundles: put the names you want in one bulk search and pay once. *Prices of 12 November 2026 in US dollars. A UDRP complaint at WIPO starts at USD 1,500 for one to five domains with a single panelist.* | Set | Extensions | Per year | Over 3 years | | --- | --- | --- | --- | | Core set | .com, .net, .org, .io, .xyz, .app | $128.94 | $386.82 | | Token launch | .com, .io, .xyz, .app, .finance, .network | $195.94 | $587.82 | | Finance words | .finance, .exchange, .money, .cash, .capital, .fund | $296.94 | $890.82 | | Endings phishers use | .xyz, .pro, .info, .shop, .online, .icu, .click, .live, .support | $212.41 | $637.23 | *Last checked on November 12, 2026; older figures carry their own date.* ## What does each variant do once it is yours? A defensive domain should be useful and silent: it sends visitors to your real site and cannot be used to send mail in your name. - **[Forwards to your site](https://wardmint.com/guides/redirect-defensive-domains/ "How do you redirect defensive domains to your main site?")** — Free URL forwarding sends every ending and typo to your main domain. - **[Sends no email](https://wardmint.com/guides/stop-email-spoofing-on-unused-domains/ "How do you stop email spoofing on unused domains?")** — The no-email template publishes a null MX, SPF -all and DMARC p=reject in one click. - **[Never lapses](https://wardmint.com/guides/stop-domains-expiring/ "How do you stop your domains from expiring?")** — Automatic renewal from your balance, so a variant does not drop and get caught by someone else. - **[Signed and locked](https://wardmint.com/guides/secure-domain-against-dns-hijacking/ "How do you secure your domain against DNS hijacking?")** — Managed DNSSEC, CAA records and a transfer lock you control for each domain. ## Which extensions can you register here? Twenty-nine endings: the ones users trust, the finance words, and the endings that carry the most phishing in Interisle's data. We do not sell .top: its renewal leaves no room under Namecheap's price. | Extension | 1st year | Renewal | Transfer | WHOIS privacy | Restrictions | | --- | --- | --- | --- | --- | --- | | .com | $12.49 | $12.49 | $12.49 | Free | None | | .net | $13.49 | $13.49 | $13.49 | Free | None | | .org | $12.49 | $12.49 | $12.49 | Free | None | | .io | $59.49 | $59.49 | $59.49 | Free | None | | .ai | $88.49 | $88.49 | $88.49 | Free | min. 2 years · sold 2 years at a time; a transfer is billed 2 years (transfer + 1 renewal) | | .co | $33.49 | $33.49 | $33.49 | Free | None | | .app | $15.99 | $15.99 | $15.99 | Free | None | | .dev | $13.49 | $13.49 | $13.49 | Free | None | | .xyz | $14.99 | $14.99 | $14.99 | Free | None | | .info | $23.49 | $23.49 | $23.49 | Free | None | | .online | $30.49 | $30.49 | $30.49 | Free | None | | .shop | $33.49 | $33.49 | $33.49 | Free | None | | .tech | $54.49 | $54.49 | $54.49 | Free | None | | .biz | $20.49 | $20.49 | $20.49 | Free | None | | .icu | $16.99 | $16.99 | $16.99 | Free | None | | .live | $32.49 | $32.49 | $32.49 | Free | None | | .pro | $23.49 | $23.49 | $23.49 | Free | None | | .link | $7.99 | $7.99 | $7.99 | Free | None | | .click | $11.49 | $11.49 | $11.49 | Free | None | | .network | $32.49 | $32.49 | $32.49 | Free | None | | .finance | $60.49 | $60.49 | $60.49 | Free | None | | .money | $32.49 | $32.49 | $32.49 | Free | None | | .exchange | $35.99 | $35.99 | $35.99 | Free | None | | .capital | $65.99 | $65.99 | $65.99 | Free | None | | .fund | $65.99 | $65.99 | $65.99 | Free | None | | .cash | $35.99 | $35.99 | $35.99 | Free | None | | .trade | $5.99 | $5.99 | $5.99 | Free | None | | .ventures | $54.99 | $54.99 | $54.99 | Free | None | | .support | $25.49 | $25.49 | $25.49 | Free | None | *29 extensions · prices per year in USD* Prices in US dollars per year, grid dated 12 November 2026, the same at renewal and on a transfer in. A .ai is sold 2 years at a time. ## How do you protect a name in an afternoon? 1. **List your variants** — Your name on other endings, plus the typos and look-alikes that matter. The defensive list guide gives the method. 2. **Bulk search** — Paste up to 50 names; the search shows which are free and their price per year. 3. **Pay once in crypto** — One top-up in BTC, USDT, USDC, ETH, SOL, LTC from a wallet, a treasury or a multisig. Send the exact amount shown, then click I've sent the payment. 4. **Make them silent** — Apply the no-email template, set forwarding to your main site and leave automatic renewal on. ## What does Wardmint not do? **Wardmint registers domains for the brand that owns them, and nothing beyond that.** We do not register look-alikes of a brand you do not own: that is typosquatting, and our acceptable-use policy bans it. We do not sell a monitoring subscription or a takedown service either. When a phishing site copies your project, the fastest route is the official one, and the guide on [how to report a phishing domain](https://wardmint.com/guides/report-a-phishing-domain/ "How to report a phishing domain") lists the registrar, host, browser and wallet blocklists to contact, with the evidence each one asks for. For a domain that should not name a founder anywhere, the optional [Domain protection](https://wardmint.com/domain-protection/ "What is Domain protection for a brand's domains?") registers it in the name of DomaineGoat LLC for $29 a year, with a transfer lock and a person reading every complaint before any action. We release the data we hold only when Panamanian law requires it (a Panamanian court or prosecutor's order), or in a UDRP case. ## Common questions ### Can a DAO pay for its domains without a person uploading an ID? Yes. Wardmint asks no ID: each domain needs one verified email, as ICANN requires. Any wallet, treasury or multisig can send the top-up in BTC, USDT, USDC, ETH, SOL, LTC. ### How many domains should a small project register? Start with your name on .com, .io, .xyz and .app, add the finance word you would use yourself, and two or three typos of your name. That is six to ten domains, about $128.94 a year for the core six. ### Do you monitor new look-alike domains for us? No. We register and manage your own domains. The guides show free tools such as dnstwist and certificate-transparency logs to watch for new look-alikes. ### Will renewals cost more than the first year? No. Each extension has one price every year, so a defensive set costs the same in year three as in year one. ### Can I register a look-alike of another project to protect users? No. Registering a name that copies a brand you do not own is typosquatting and is banned by our acceptable-use policy. Report the phishing domain instead. **Check which of your variants are still free** Paste up to 50 names, pay once in crypto, make them forward and stay silent. [Check your variants](https://wardmint.com/app/domains/?lang=en) · [Which domains to register](https://wardmint.com/which-domains-should-a-crypto-project-register/ "Which domains should a crypto project register?") --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # What is Wardmint, and who runs it? > Wardmint registers defensive domains for crypto projects, paid in crypto with no KYC. It is run by DomaineGoat LLC, a company registered in Panama. - URL: https://wardmint.com/about/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) A registration service for one job: holding the names around a crypto project's brand before someone else does. **Quick answer — What is Wardmint, and who runs it?** **Wardmint** registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, incorporated in Panama. ## Wardmint at a glance | Attribute | Value | | --- | --- | | Operator | DomaineGoat LLC, incorporated in Panama | | Role | Reseller of domain registrations. DomaineGoat LLC is not an ICANN-accredited registrar; domains are registered through our ICANN-accredited registrar partner | | Extensions | 29, from .com $12.49/year to the finance words and the endings phishers use | | Price rule | One price every year; each extension under Namecheap's regular renewal price read on 12 November 2026 | | Payment | Crypto only: BTC, USDT, USDC, ETH, SOL, LTC, from a prepaid balance, minimum top-up $25 | | Identity | No ID. One email address per domain, required, verified and kept private | | Support | support@wardmint.com: email replies within 12 hours, 7 days a week, including help with DNSSEC, CAA records and abuse reports | | Abuse | abuse@wardmint.com, no account needed | ## What does Wardmint sell? **Wardmint sells domain registrations for the defence of a brand, and nothing else.** A project that launches a token or a wallet attracts copies of its name: another extension, a typo, a hyphenated combination. Wardmint lets the project hold those names first. You search up to 50 names at once, pay once from a prepaid balance, and each name gets free DNS, URL forwarding, managed DNSSEC and a no-email template. The [how it works page](https://wardmint.com/how-it-works/ "How does Wardmint work?") describes the steps, and the [pricing page](https://wardmint.com/pricing/ "Wardmint domain prices") lists every extension. ## What does Wardmint not sell? **Wardmint does not run brand monitoring, takedown services or a registry lock, and it does not register look-alikes of another brand.** - **No monitoring and no takedown.** Our guides show the free tools and the official procedures, so a team can do these jobs itself. - **No look-alikes of others.** We register a brand's own variants for that brand. A customer who registers a name that imitates a brand it does not own breaks the [acceptable use policy](https://wardmint.com/acceptable-use/ "Wardmint acceptable use policy"), and the domain can be suspended. - **No registry lock.** We offer a transfer lock for each domain and the [Domain protection](https://wardmint.com/domain-protection/ "What is Domain protection for a brand's domains?") option. - **No .top.** Its price leaves no room under Namecheap's renewal, so we do not sell it. ## Who runs Wardmint? **DomaineGoat LLC, a company incorporated in Panama, operates Wardmint.** It sells and supports the service. It is not a registrar: domains are registered through our ICANN-accredited registrar partner, and the domain is in the customer's name as registrant of record, unless the customer adds Domain protection. This site does not name individuals as authors, and no page claims customer numbers, reviews or awards. ## What data do we collect? **One email address per domain, and nothing that identifies a person by document.** ICANN requires a verified contact for every domain, so the address is required and verified after registration. It is kept private. We ask for no ID document, no selfie and no ID number. We release the data we hold only when Panamanian law requires it (a Panamanian court or prosecutor's order), or in a UDRP case. The [privacy policy](https://wardmint.com/legal/privacy/ "Wardmint privacy policy") gives the detail. ## How is the money handled? **Payment is in crypto only, from a prepaid balance.** The coins accepted are BTC, USDT, USDC, ETH, SOL, LTC. You send the exact amount, click I've sent the payment, and the balance is credited once the payment is confirmed. Unused balance stays on your account and never expires, and it pays for new domains, renewals and transfers. When a purchase costs less than the minimum top-up, the part added only to reach the minimum is refundable on request to support within 30 days of the payment, in USDT or USDC, as long as it has not been spent. The rest of the balance is not paid back, except where the law requires it. ## How do we handle abuse? **Phishing, malware, botnets and fraud that takes money from victims lead to action within 24 hours of a well-documented report.** Child sexual abuse material is handled immediately, with a report to the competent hotline or authority. A domain is locked within 2 business days of a request from a UDRP provider. A copyright, defamation, political or competitor complaint leads to no action on the complaint alone: it takes a decision that binds us. The process is on the [abuse page](https://wardmint.com/abuse/ "How do I report abuse on a Wardmint domain?"). ## How can I check what this site says? Competitor prices carry the date they were read, and incidents and statistics cite their sources. If a page is wrong, write to support@wardmint.com with the page address and the correction, and we will check it. **Protect your name** Search your variants and see the price of each. [Check your variants](https://wardmint.com/app/domains/?lang=en) · [Contact](https://wardmint.com/contact/ "How do I contact Wardmint?") --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # How do I report abuse on a Wardmint domain? > Report phishing, malware, botnets or fraud on a Wardmint domain to abuse@wardmint.com, no account needed. Action within 24 hours of a documented report. - URL: https://wardmint.com/abuse/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) Anyone can report a domain registered through Wardmint: victims, security teams, registries, researchers and authorities. One email is enough. **Quick answer — How do I report abuse on a domain registered through Wardmint?** To report a **Wardmint** domain, email **abuse@wardmint.com**; no account is needed. Phishing, malware, botnets and fraud that takes money from victims lead to action within 24 hours of a well-documented report, and child sexual abuse material is handled immediately, with a report to the competent hotline or authority. Each report gets an acknowledgement with a reference number. ## The abuse desk in short | Attribute | Value | | --- | --- | | Address | abuse@wardmint.com | | Who can report | Anyone, without an account, a login or a form | | Acknowledgement | an acknowledgement with a reference number | | Phishing, malware, botnets | Action within 24 hours of a well-documented report | | Fraud that takes money from victims | Action within 24 hours of a well-documented report | | Child sexual abuse material | Handled immediately, with a report to the competent hotline or authority | | Trademark disputes | UDRP; the domain is locked within 2 business days of a request from a UDRP provider | | Any other complaint | Reply within 2 business days | ## 1. Who can report, and how Wardmint registers defensive domains for crypto projects. It is operated by DomaineGoat LLC, incorporated in Panama, and domains are registered through our ICANN-accredited registrar partner. Write to abuse@wardmint.com from any address. There is no form and no account. Send one email per domain, or one email that lists the domains of a single campaign, in English if you can. ## 2. What a useful report contains A report that shows the abuse is acted on faster. Include: - the domain and the exact URL where the abuse appears; - the type of abuse: phishing, malware, botnet or fraud; - evidence: a dated screenshot (UTC), the email with its full headers, a file hash or a scan result; - the date and time you saw it, and whether it was online when you wrote; - a way to reach you, if you want the outcome. For child sexual abuse material, send the link and nothing else. Do not download, copy or attach the material, and also alert your national hotline. ## 3. What happens to each type of report | Type | Examples | Our response | | --- | --- | --- | | Phishing | Fake login pages, wallet-connect pages that imitate a project, DNS records that send users to a fake site | Action within 24 hours of a well-documented report | | Malware | Domains that serve or control harmful software | Action within 24 hours of a well-documented report | | Botnets | Command-and-control domains | Action within 24 hours of a well-documented report | | Fraud that takes money from victims | Fake airdrops, wallet drainers, investment scams, impersonation of a project | Action within 24 hours of a well-documented report | | Child sexual abuse material | Any such material | Handled immediately, with a report to the competent hotline or authority | | Trademark disputes | A name that copies a registered mark | UDRP; locked within 2 business days of a request from a UDRP provider | | Other complaints | Copyright, defamation, political or competitor complaints | Reply within 2 business days; no action on the complaint alone | ## 4. Trademark disputes A trademark dispute follows the Uniform Domain-Name Dispute-Resolution Policy (UDRP). The mark holder files with an approved provider, not with us. The domain is then locked within 2 business days of a request from a UDRP provider, so it cannot change registrar or registrant while the case runs, and the panel's decision is carried out. The guide to [filing a UDRP complaint](https://wardmint.com/guides/file-a-udrp-complaint/ "How to file a UDRP complaint") describes the procedure. ## 5. Complaints that need a decision A complaint about copyright, defamation, politics or a competitor leads to no action on the complaint alone. We act on such a matter when a decision binds us, for example a Panamanian court order. We do not judge the merits of these disputes ourselves. ## 6. Domain protection and abuse [Domain protection](https://wardmint.com/domain-protection/ "What is Domain protection for a brand's domains?") does not change this policy: a domain with the option follows the same rules and timings. The option adds one step, a person who reads every complaint before any action on the domain. That review exists only for domains with the option. ## 7. Registrant data A report does not give the sender access to the data we hold about the registrant. We release the data we hold only when Panamanian law requires it (a Panamanian court or prosecutor's order), or in a UDRP case. ## 8. Other places to report Report the same site in parallel to the host of the website, who can remove the content while the domain stays online, and to the registry of the extension. The registrar's abuse contact is in the public RDAP record of the domain. The guide to [reporting a phishing domain](https://wardmint.com/guides/report-a-phishing-domain/ "How to report a phishing domain") lists the other channels. Rules for customers are in the [acceptable use policy](https://wardmint.com/acceptable-use/ "Wardmint acceptable use policy"). --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # What is not allowed on a Wardmint domain? > Wardmint bans look-alikes of brands you do not own, phishing, wallet drainers, fake airdrops, impersonation, malware, CSAM and fraud on every domain. - URL: https://wardmint.com/acceptable-use/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) The rules for every customer and every domain. They apply with or without Domain protection. **Quick answer — What is not allowed on a Wardmint domain?** **Wardmint** exists to defend brands, so it bans registering look-alikes of a brand you do not own. It also bans phishing, wallet drainers, fake airdrops, impersonation, malware, botnets, fraud that takes money from victims, and child sexual abuse material. These rules apply to every domain, whether or not it has Domain protection. ## 1. Registering names that imitate a brand you do not own You may register your own brand's variants: other extensions, typos, hyphenated forms and look-alikes of **your** name. You may not register a name that imitates the name, token, product or website of a person or project that is not you or your client, whatever you plan to do with it. That is typosquatting. It includes misspellings, omitted or doubled letters, added words such as "login" or "claim", extension swaps and characters that look alike from other scripts. If you register a name that is close to another project's brand, you must be able to show that you own the brand or act for its owner when we ask. ## 2. Phishing, drainers and fake airdrops You may not use a domain to collect credentials, seed phrases or wallet approvals by deceit. This covers fake login and wallet-connect pages, pages that ask a user to sign a malicious transaction, drainer kits, fake airdrops and claim pages, fake support desks and cloned websites of a project or an exchange. ## 3. Impersonation and fraud You may not impersonate a person, a team, a company or a project. You may not run a scam that takes money from victims, such as a fake investment platform, a fake token sale or a fake giveaway. ## 4. Malware and botnets You may not use a domain to distribute malware, to control infected machines or to host command-and-control servers. You may not run pharming, which sends users to a fake site by tampering with DNS. ## 5. Child sexual abuse material Child sexual abuse material is banned absolutely. It is handled immediately, with a report to the competent hotline or authority. ## 6. Spam and email abuse You may not send unsolicited bulk email from a domain, or use a domain to forge the sender address of another party. The no-email DNS template that Wardmint provides exists to stop that kind of use of an idle domain. ## 7. What we do when a rule is broken Phishing, malware, botnets and fraud that takes money from victims lead to action within 24 hours of a well-documented report. The action can be suspension of the domain or of its DNS. A copyright, defamation, political or competitor complaint leads to no action on the complaint alone; it takes a decision that binds us. A UDRP provider's request locks the domain within 2 business days of a request from a UDRP provider. The reporting process is on the [abuse page](https://wardmint.com/abuse/ "How do I report abuse on a Wardmint domain?"). ## 8. Domain protection does not change the rules A domain with [Domain protection](https://wardmint.com/domain-protection/ "What is Domain protection for a brand's domains?") follows the same rules and timings. The only difference is that a person reads each complaint before any action. ## 9. Changes We may update this policy. The version date at the top shows the current text, and the [terms of service](https://wardmint.com/legal/terms/ "Wardmint terms of service") explain how changes apply. --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # What is the best domain registrar for crypto projects? > Best domain registrar for crypto projects: six criteria and a dated price table. Wardmint .com is $12.49/year versus Namecheap's $19.98 renewal. - URL: https://wardmint.com/best-domain-registrar-for-crypto-projects/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) No single registrar wins on every point. A crypto project should rank them on how it pays, what it must disclose, how well it can lock the domain, and what the name costs in year two. **Quick answer — What is the best domain registrar for crypto projects?** The best registrar for a crypto project is the one that meets six criteria: payment it can make from a treasury, no needless identity documents, strong locks, DNSSEC, quick abuse handling and a stable renewal price. **Wardmint** meets the first two with BTC, USDT, USDC, ETH, SOL, LTC and no KYC, and charges $12.49/year for .com every year. ## Renewal prices on five extensions, 12 November 2026 *Namecheap: regular renewal as listed on domainoffer.net (namecheap.com answered HTTP 403 to our reader). Porkbun: official pricing API. Cloudflare: cfdomainpricing.com, at-cost, secondary; its .com figure predates the 1 November 2026 Verisign increase and is probably stale. Wardmint: one price every year.* | Extension | Namecheap renewal | Porkbun renewal | Cloudflare renewal | Wardmint (every year) | | --- | --- | --- | --- | --- | | .com | $19.98 | $11.81 | $10.46 | $12.49/year | | .io | $60.78 | $51.80 | $50.00 | $59.49/year | | .xyz | $21.48 | $14.21 | $11.20 | $14.99/year | | .app | $22.98 | $14.93 | $14.20 | $15.99/year | | .finance | $92.98 | $58.19 | $50.20 | $60.49/year | *Last checked on November 12, 2026; older figures carry their own date.* ## Which criteria matter for a crypto project? **Six criteria decide the choice, and price is only the last of them.** A project that loses its domain loses its users, so the account controls come before the discount. 1. **How you pay.** A DAO or foundation pays from a treasury or multisig. A registrar that only takes cards forces someone to pay personally and be reimbursed. Wardmint takes BTC, USDT, USDC, ETH, SOL, LTC from a prepaid balance with a $25 minimum. 2. **What you must disclose.** ICANN requires a verified email for the registrant. Beyond that, registrars differ on identity documents. Wardmint asks for none: no ID, one verified email per domain, kept private. 3. **Locks.** A transfer lock stops a move to another registrar. A registry lock, offered by Verisign for .com and .net, also blocks DNS and ownership changes made with account credentials alone. Wardmint offers the transfer lock and Domain protection; it does not offer registry lock. 4. **DNSSEC and CAA.** Wardmint provides free DNS hosting with A, AAAA, CNAME, ALIAS, MX, TXT, NS, SRV and CAA records, managed DNSSEC, and your own nameservers if you prefer (2 to 13). Cloudflare's documentation describes one-click DNSSEC activation. 5. **Abuse handling.** Under ICANN's amendments in force since 5 April 2024, every accredited registrar must act promptly on actionable evidence of phishing. Wardmint's own commitment: action within 24 hours of a well-documented report. 6. **Price in year two.** A first-year promotion matters little for a name held for a decade. Compare the renewal price, as the table above does. ## How do Namecheap, Porkbun and Cloudflare compare on price? **Porkbun and Cloudflare are cheaper than Wardmint on every extension Wardmint sells, and Wardmint is cheaper than Namecheap's regular renewal on all of them.** Wardmint does not claim to be the cheapest. Cloudflare says it sells domains at cost, with no markup, and its renewals follow the registry list price. Porkbun's renewal of $11.81 for a .com sits close to the wholesale floor. Namecheap's regular .com renewal is $19.98, against $12.49/year at Wardmint. What the price table does not show is whether each registrar accepts a given coin or asks for identity documents. Wardmint did not verify the payment methods or identity rules of the other three on 12 November 2026, so it makes no claim about them: check their current terms before you rely on a comparison. The case for Wardmint is narrow and stated: a crypto-only checkout with no KYC, 29 extensions chosen for defensive registration, and a bulk search of 50 names in one cart. For the full price grid, see [Wardmint pricing](https://wardmint.com/pricing/ "Wardmint domain prices for 29 extensions"). ## Should the main domain and the defensive domains share a registrar? **Keep the main domain and the defensive domains in separate accounts when you can.** If one account is compromised, only part of the portfolio is exposed. The recorded hijacks show why: the Squarespace wave of 9 to 12 July 2024 hit domains migrated from Google Domains, including those of Compound, Celer and Pendle, through what Squarespace called a weakness related to OAuth logins. A common split is a registrar with registry lock for the one name that holds the front end, and a low-cost registrar for the variants that only redirect. Wardmint is built for the second job. It does not sell registry lock, so a team that wants it for its primary .com should hold that name where the lock is offered and run its variants here. The account itself needs the same care at any registrar; [how to protect your registrar account from takeover](https://wardmint.com/guides/protect-registrar-account/ "How to protect your registrar account from takeover") lists the steps. ## How should a DAO pick and pay? **A DAO should choose a registrar that accepts a treasury payment and holds the account in a role, not a person.** Decide who holds the login, who can top up, and who answers the renewal reminder, then write it down. Wardmint's balance is prepaid, and the part of a top-up that only reaches the minimum is refundable on request within 30 days in USDT or USDC if unspent; the rest of the balance never expires and is not paid back. The detail on roles and multisig flows is in [how a DAO should hold and pay for its domains](https://wardmint.com/dao-domain-security/ "How should a DAO hold and pay for its domains?") and in [how to pay for domains from a DAO treasury in USDC or USDT](https://wardmint.com/pay-for-domains-with-usdc/ "How to pay for domains from a DAO treasury in USDC or USDT"). According to Wardmint's survey of 12 November 2026, Porkbun's renewal price was lower than Wardmint's on all 29 extensions Wardmint sells, Cloudflare's was lower on all 29, and Wardmint's was under Namecheap's regular renewal on all 29, by a median of 33%. Wardmint is a registration service for crypto projects that pay without identity documents; it is not the lowest-priced registrar. ## Registrars for crypto projects: questions ### Is Cloudflare the best registrar for a crypto project? Cloudflare sells at cost and offers one-click DNSSEC, which suits a team that already uses its DNS. Wardmint did not verify its crypto payment options or identity rules, so check those before choosing. ### Can I register a domain for a DAO without ID? At Wardmint, yes: no identity document is requested, only one verified email per domain, as ICANN requires. The domain is registered in the customer's name. ### Does Wardmint offer registry lock? No. Registry lock is a Verisign service offered through participating registrars for .com and .net. Wardmint offers a transfer lock and the Domain protection option at +$29/year. ### Why does Wardmint cost more than Porkbun? Wardmint prices each extension under Namecheap's regular renewal, not under Porkbun's. What Wardmint adds is a crypto-only checkout, a bulk search of 50 names and support within hours, and it does not claim to be the cheapest. ### Should I use one registrar for everything? Splitting the portfolio limits the damage of one compromised account. Put the primary domain where registry lock is available and the redirecting variants where they are cheap to hold. **In summary** - Six criteria: payment, disclosure, locks, DNSSEC and CAA, abuse handling, renewal price. - Wardmint takes BTC, USDT, USDC, ETH, SOL, LTC with no KYC and one verified email per domain. - Wardmint .com costs $12.49/year every year; Namecheap's regular renewal is $19.98. - Porkbun and Cloudflare were cheaper than Wardmint on all 29 extensions on 12 November 2026. - Wardmint has no registry lock; it has a transfer lock and Domain protection. - Wardmint did not verify the payment or identity rules of the other registrars. - Splitting the portfolio across accounts limits the damage of one takeover. ## Sources 1. [Namecheap .com renewal listing](https://domainoffer.net/tld/com/namecheap) — domainoffer.net (read 2026-11-12) 2. [Porkbun pricing API](https://api.porkbun.com/api/json/v3/pricing/get) — Porkbun (read 2026-11-12) 3. [Domain price list](https://cfdomainpricing.com/) — cfdomainpricing.com (read 2026-11-12) 4. [Cloudflare Registrar documentation](https://developers.cloudflare.com/registrar/) — Cloudflare (read 2026-11-12) 5. [Registry Lock](https://www.verisign.com/resources/registrar-resources/registry-lock) — Verisign (read 2026-11-12) 6. [Researchers: weak security defaults enabled Squarespace domains hijacks](https://krebsonsecurity.com/2024/07/researchers-weak-security-defaults-enabled-squarespace-domains-hijacks/) — Krebs on Security (read 2026-11-12) 7. [Advisory: compliance with DNS abuse obligations](https://www.icann.org/en/contracted-parties/advisories/documents/advisory-compliance-with-dns-abuse-obligations-in-the-registrar-accreditation-agreement-and-the-registry-agreement-05-02-2024-en) — ICANN (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # How do I contact Wardmint? > Write to support@wardmint.com for orders, DNS and transfers, or abuse@wardmint.com to report a phishing domain. Support replies by email, 7 days a week. - URL: https://wardmint.com/contact/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) Two email addresses cover every case. Here is which one to use and what to put in the message. **Quick answer — How do I contact Wardmint?** Email **support@wardmint.com** for orders, top-ups, DNS, renewals, transfers and corrections to this site, or **abuse@wardmint.com** to report a phishing site on one of our domains. Support: email replies within 12 hours, 7 days a week, including help with DNSSEC, CAA records and abuse reports. Write in English and name the domain concerned. ## Contacts | Attribute | Value | | --- | --- | | Support | support@wardmint.com | | Abuse reports | abuse@wardmint.com, no account needed | | Support replies | email replies within 12 hours, 7 days a week, including help with DNSSEC, CAA records and abuse reports | | Abuse acknowledgement | an acknowledgement with a reference number | | Language | English | | Operator | DomaineGoat LLC, incorporated in Panama | | What we never ask | We never ask for your password, your account number or your domain transfer (EPP) codes by email or chat | ## Which address should I write to? | Your case | Address | Include | | --- | --- | --- | | A payment, a top-up or a refund of the minimum-top-up part | support@wardmint.com | The coin, the amount and the transaction ID | | DNS, DNSSEC, CAA or forwarding | support@wardmint.com | The domain and what you set | | A transfer or the EPP code | support@wardmint.com | The domain and the destination registrar | | Domain protection: add, keep or end | support@wardmint.com | The domain and the word Domain protection | | A phishing, malware or fraud site on a Wardmint domain | abuse@wardmint.com | The URL, a dated screenshot and the evidence | | A UDRP provider's notice | abuse@wardmint.com | The case number and the provider | | A mistake on this site | support@wardmint.com | The page address and the correction | ## What should I put in a support message? **Name the domain and describe what you expected to happen.** For a payment, add the coin, the exact amount and the transaction ID. For DNS, paste the record as you entered it. One message per problem is quicker to answer. We never ask for your password, your account number or your domain transfer (EPP) codes by email or chat. A message that asks for them did not come from us. ## How do I report abuse? Write to abuse@wardmint.com; no account or form is needed. The [abuse page](https://wardmint.com/abuse/ "How do I report abuse on a Wardmint domain?") lists what a useful report contains and the time we take for each type of report. ## Where do legal requests go? Send them to support@wardmint.com, addressed to DomaineGoat LLC, incorporated in Panama. We release the data we hold only when Panamanian law requires it (a Panamanian court or prosecutor's order), or in a UDRP case. A complaint about copyright, defamation, politics or a competitor leads to no action on the complaint alone; it takes a decision that binds us. **Looking for an answer first?** Most questions about prices, payment and transfers are in the FAQ. [Read the FAQ](https://wardmint.com/faq/ "What should a crypto project know before buying defensive domains?") · [Check your variants](https://wardmint.com/app/domains/?lang=en) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # What is the domain security checklist for a crypto project? > Ten checks keep a crypto project's domains safe: account 2FA, transfer lock, DNSSEC, CAA, DMARC, monitoring, variants, renewal. Core set $128.94. - URL: https://wardmint.com/crypto-project-domain-security-checklist/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) A project's contracts can be flawless and its users can still lose funds, because they reach the contracts through a domain. This list covers the domain layer in the order that gives the most protection first. **Quick answer — What is the domain security checklist for a crypto project?** A crypto project's domain security checklist has ten checks: a protected registrar account with two-factor authentication, a transfer lock, a registry-lock decision, DNSSEC, CAA records, email authentication on every domain, certificate monitoring, defensive variants, redirects and renewal. **Wardmint** sells the registrations and the DNS tools; its core set of six extensions is $128.94 a year. ## The ten checks and the guide for each *Controls named in the Curve (12 May 2025), Squarespace (July 2024), February 2026 and eth.limo (April 2026) incident reports; guides are Wardmint pages.* | # | Check | What it blocks | Done with | | --- | --- | --- | --- | | 1 | Registrar account: unique password, 2FA, few users | Account takeover | Your registrar login and a vault | | 2 | Transfer lock on every domain | Silent move to another registrar | Client area: a transfer lock you switch on or off for each domain in the client area; the transfer (EPP) code is requested there too | | 3 | Registry lock for a critical .com or .net | Changes made with credentials alone | A registrar that sells it; Wardmint does not | | 4 | DNSSEC | Forged DNS answers on the path | Managed DNSSEC in the DNS tools | | 5 | CAA records | Certificates from an unexpected authority | CAA record in the DNS tools | | 6 | Null MX, SPF -all, DMARC p=reject on every domain | Spoofed email from unused names | The no-email DNS template | | 7 | Certificate Transparency monitoring | Look-alike and hijack certificates going unseen | crt.sh or a certificate stream (free) | | 8 | Defensive variants of the name | Look-alike domains bought by others | Bulk search of up to 50 names | | 9 | Redirects from every variant to the official site | A mistyped address landing on a stranger | Free URL forwarding | | 10 | Auto-renew and a funded balance | A lapsed name picked up by a third party | Automatic renewal from the balance | ## Why does a crypto project need a domain checklist at all? **Because the domain is the one part of the front end that an attacker can take without breaking any code.** Curve Finance reported that on 12 May 2025 the delegation of curve.fi was changed at its registrar, and that visitors saw a static decoy of its homepage whose only purpose was to obtain wallet signatures. Curve stated that the protocol and its contracts stayed secure and that no data was compromised. Blockaid's write-up of five front-end compromises between 16 and 23 February 2026 describes the same chain: social engineering of registrar support, redirection of DNS to attacker hosting, new SSL certificates issued, and a cloned front end carrying a drainer. Each check below breaks one link of that chain. ## Which checks protect the registrar account (1 to 3)? **Start with the login, because every hijack in the reports went through a person or an account.** Give the registrar account a long unique password, turn on two-factor authentication, and list who can sign in. The researchers who analysed the July 2024 Squarespace hijacks, reported by Krebs on Security on 15 July 2024, advised enabling multi-factor authentication, finding out which email addresses have access and removing unneeded users. Name.com gave the same two instructions after the 30 and 31 October 2026 redirections: check DNS records and enable two-factor authentication. The routine is written out in [how to protect your registrar account from takeover](https://wardmint.com/guides/protect-registrar-account/ "How to protect your registrar account from takeover"). Next, switch on the transfer lock for every domain, so a move to another registrar needs you to lift it first. For a main .com or .net, decide whether to buy registry lock from a registrar that offers it. It is separate from the transfer lock, and [registry lock vs registrar lock](https://wardmint.com/registry-lock-vs-registrar-lock/ "Registry lock vs registrar lock: what is the difference?") explains the difference. Wardmint does not offer registry lock and says so. ## Which DNS checks come next (4 and 5)? **Sign the zone and restrict certificate issuance.** DNSSEC lets resolvers reject forged answers. When the eth.limo domain was taken through a social-engineering attack on its registrar and DNS provider in April 2026, Cointelegraph reported that DNSSEC was enabled, that the attacker lacked the signing keys, and that resolvers rejected the forged responses, which eth.limo said likely reduced the blast radius. DNSSEC does not stop someone who holds the account, because that person can change the DS record, so it sits after the account checks, not instead of them. Setup is in [how to enable DNSSEC on your domain](https://wardmint.com/guides/enable-dnssec/ "How to enable DNSSEC on your domain"). CAA records name the certificate authorities allowed to issue for the domain. Blockaid noted certificates issued the same day as the DNS change in the February 2026 cases, so a CAA record that names only your authority forces an attacker to change it first, which is a visible event. The syntax is in [how to set up CAA records](https://wardmint.com/guides/set-up-caa-records/ "How to set up CAA records"). ## How do you stop unused domains being used against you (6 and 9)? **Give every domain you own a stated purpose: send mail nowhere and send web traffic to the official site.** A defensive name with no email policy can be forged in a phishing message from your brand. The no-email template sets a null MX, an SPF record of v=spf1 -all and a DMARC policy of p=reject, so receivers drop such mail. Wardmint provides a "no email" DNS template (null MX, SPF -all, DMARC p=reject) so a defensive domain cannot be used to spoof your mail, free URL forwarding to send every variant to your main site, and automatic renewal from your balance so no variant lapses. The step-by-step version is in [how to stop email spoofing on unused domains](https://wardmint.com/guides/stop-email-spoofing-on-unused-domains/ "How to stop email spoofing on unused domains"). On the web side, a variant that answers with a 301 redirect to your site turns a mistyped address into a visit to the right place and keeps the name from showing a parked page. See [how to redirect defensive domains to your main site](https://wardmint.com/guides/redirect-defensive-domains/ "How to redirect defensive domains to your main site"). ## How do you watch for look-alikes and hijacks (7)? **Read the public trail: every publicly trusted certificate is logged.** Search Certificate Transparency for your brand string weekly, or stream new entries and filter them. A certificate for a name you did not request is the earliest public sign of either a look-alike site or a hijack in progress. The tools and queries are in [how to monitor certificate transparency for your brand](https://wardmint.com/guides/monitor-certificate-transparency/ "How to monitor certificate transparency for your brand"). Wardmint does not sell monitoring; the free tools cover this check. Also keep a second official address ready. Curve pointed users to curve.finance as an interim access point during the outage of 12 May 2025, and that was possible because it controlled a second domain. ## Which variants and renewals complete the list (8 and 10)? **Own the exact name on the main extensions and the claim, airdrop and wallet words on the ones phishers use, then never let any of them lapse.** According to Wardmint's survey of 12 November 2026, 171 of 578 variants of the 50 largest crypto projects' domains (29.6%) were unregistered in RDAP, and 40 of 50 -claim .com names and 39 of 50 -airdrop .com names were free; the method and limits are on the [crypto project defensive domain audit 2026](https://wardmint.com/data/crypto-project-defensive-domain-audit-2026/ "How many look-alike domains of the top crypto projects can anyone register?") page. Build your own list with [how to build a defensive domain list for your brand](https://wardmint.com/guides/build-a-defensive-domain-list/ "How to build a defensive domain list for your brand"). Then protect it from expiry: switch on automatic renewal from your balance, switched on or off for each domain and keep the balance funded, as explained in [how to stop your domains from expiring](https://wardmint.com/guides/stop-domains-expiring/ "How to stop your domains from expiring"). Prices stay the same every year, so a treasury can budget a set: the core set (.com, .net, .org, .io, .xyz, .app) is $128.94 a year. ## What is the short version to quote? A crypto project secures its domains by hardening the registrar account first, locking transfers, signing DNS, restricting certificates, silencing unused domains for email, watching certificate logs, owning its obvious variants and renewing automatically. Wardmint registers the defensive domains a crypto project needs, paid in crypto with no KYC: no ID, only one verified email per domain, and it does not claim that registration alone stops phishing. ## Domain security checklist: questions ### Which check should a crypto project do first? Secure the registrar account with a unique password, two-factor authentication and a short list of users. The incidents reported in 2024, 2025 and 2026 all involved a registrar or DNS account or a support process, so that is where the first hour goes. ### Does DNSSEC alone prevent a hijack? No. It makes forged answers fail validation, as it did for eth.limo in April 2026, but someone who controls the registrar account can replace the DS record. Pair it with account security and a transfer lock. ### Do defensive domains need email records? Yes, the opposite of a normal setup: a null MX, an SPF -all record and DMARC p=reject, so nobody can send mail that appears to come from the name. The no-email template at Wardmint applies this in one step. ### How often should I check certificate logs? Weekly is a workable minimum for a search, and a certificate stream gives near-real-time alerts. Either way, treat a certificate you did not order as an incident. ### Can a DAO treasury pay for the defensive names? Yes. Wardmint accepts BTC, USDT, USDC, ETH, SOL, LTC into a prepaid balance with a $25 minimum top-up, and a multisig can send the payment. Each domain needs one verified email and no identity documents. **In summary** - Ten checks: account and 2FA, transfer lock, registry-lock decision, DNSSEC, CAA, email records, monitoring, variants, redirects, renewal. - Curve (12 May 2025) lost control of its delegation at the registrar while its contracts stayed intact. - Blockaid (16 to 23 February 2026): support social engineering, DNS redirection, same-day certificates, cloned front end. - DNSSEC limited the eth.limo takeover of April 2026 but does not stop an account holder. - 171 of 578 variants of the top 50 projects' domains (29.6%) were free to register on 12 November 2026. - Wardmint does not offer registry lock or monitoring; it offers transfer lock, managed DNSSEC, CAA and auto-renew. - Core set of six extensions: $128.94 a year, same price to renew. ## Sources 1. [Curve domain incident](https://news.curve.finance/curve-domain-incident/) — Curve Finance (read 2026-11-12) 2. [Frontend hijacking and the Web2 attack surface threatening Web3 protocols](https://blockaid.io/blog/frontend-hijacking-and-the-web2-attack-surface-threatening-web3-protocols) — Blockaid, 19 March 2026 (read 2026-11-12) 3. [Researchers: weak security defaults enabled Squarespace domains hijacks](https://krebsonsecurity.com/2024/07/researchers-weak-security-defaults-enabled-squarespace-domains-hijacks/) — Krebs on Security, 15 July 2024 (read 2026-11-12) 4. [Hackers hijack a dozen DeFi websites registered with Name.com](https://theblock.co/news/defi/2026-10-31-hackers-hijack-a-dozen-defi-websites-all-registered-with-name-com-and-steal-about-138000-432251) — The Block, 31 October 2026 (read 2026-11-12) 5. [eth.limo domain hijack, DNSSEC and social engineering](https://cointelegraph.com/news/eth-limo-domain-hijack-dnssec-social-engineering) — Cointelegraph, 20 April 2026 (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # What is a CSC domain management alternative for startups? > CSC lists domain security and DNS services and publishes no price; Wardmint publishes 29 prices from $5.99/year, paid in crypto without ID. - URL: https://wardmint.com/csc-domain-management-alternative/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) CSC sells enterprise domain management through its sales team. A startup that only needs its names registered and locked can buy that from a public price list instead. **Quick answer — What is a CSC domain management alternative for startups?** For a startup that needs registration, DNS, locks and renewals rather than an enterprise contract, **Wardmint** is the alternative: 29 extensions at public prices, .com at $12.49/year every year, paid in crypto. CSC's website lists domain security, DNS and enforcement services, shows no price and routes buyers to a sales contact. ## CSC and Wardmint compared *Source: cscglobal.com home page, read on 12 November 2026. We did not find a services page that loaded, so detail below the listing is not quoted.* | Point | CSC | Wardmint | | --- | --- | --- | | Services listed on its site | Certificate management, DNS services, domain security, enforcement, enterprise-class domain services, fraud protection, online brand protection | Registration, DNS with managed DNSSEC and CAA, forwarding, transfer lock, automatic renewal, optional Domain protection | | Price | Not published; a Contact sales button | Published for 29 extensions; .com $12.49/year, same price to renew and transfer | | Customer profile it states | 90% of the Fortune 500 and 90% of the Interbrand 100, by its own claim | Crypto projects of any size, DAOs and treasuries | | Enforcement and monitoring | Listed as services | Not sold; guides show the free tools and the official procedures | | Payment | Not stated on the page we read | BTC, USDT, USDC, ETH, SOL, LTC, prepaid balance, minimum $25 | | Identity | Not stated on the page we read | No ID; one verified email per domain | | Renewal protection | Not stated on the page we read | automatic renewal from your balance, switched on or off for each domain | *Last checked on November 12, 2026; older figures carry their own date.* ## What does CSC offer in domain management? **CSC presents itself as a provider of digital brand and cyber risk services to large organisations.** Its home page lists certificate management, DNS services, domain security, enforcement, enterprise-class domain services, fraud protection and online brand protection. It states that it is the trusted partner of 90% of the Fortune 500, 90% of the Interbrand 100 Best Global Brands, 75% of the PEI 300 and 10,000 law firms. Those are CSC's own claims. The page gives no detail on what each service includes and publishes no price. Its contact route is a Contact sales button. We could not open a deeper CSC page, so we make no statement about contract terms, minimums or registry lock availability. ## What does a startup actually need from domain management? **A startup needs five things: the names, the right locks, clean DNS, renewals that cannot lapse, and a way to answer abuse.** None of them requires an account team. The names come from a list built on the project's own brand; the method is in [what defensive domain registration is](https://wardmint.com/defensive-domain-registration/ "What is defensive domain registration?"). The locks are a transfer lock on every domain and, for a critical .com, a registry lock at a registrar that sells one. The DNS service includes free DNS hosting with A, AAAA, CNAME, ALIAS, MX, TXT, NS, SRV and CAA records, managed DNSSEC, and your own nameservers if you prefer (2 to 13). Renewals are automatic renewal from your balance, switched on or off for each domain, paid from a balance, which matters because an expired defensive name can be registered by anyone; see [how to stop your domains from expiring](https://wardmint.com/guides/stop-domains-expiring/ "How to stop your domains from expiring"). Abuse is handled by the registrar as ICANN's 2024 amendments require, and by you with the free procedures. If the team is a DAO, the harder question is who holds the account and who pays. [How a DAO should hold and pay for its domains](https://wardmint.com/dao-domain-security/ "How should a DAO hold and pay for its domains?") covers it. ## When is an enterprise provider still the right choice? **An enterprise provider is right when enforcement, certificates and many brands must be run by someone else.** A listed exchange with dozens of brands, regulators to answer and a legal team that wants takedowns handled has needs that a registration service does not cover. CSC and the other corporate registrars sell that category, and so do web3 monitoring vendors. [The MarkMonitor comparison](https://wardmint.com/markmonitor-alternative/ "What is a MarkMonitor alternative for a small crypto team?") describes the same split. Wardmint is for the team that can run a short checklist itself. It registers your own variants, never look-alikes of another brand, and it does not run monitoring, takedown or registry lock. Where a name matters enough to need a registry lock, register that name elsewhere and use Wardmint for the rest. ## How do the offers differ in numbers? According to Wardmint's survey of 12 November 2026, the CSC page we read shows no price while Wardmint shows 29. The core set of .com, .net, .org, .io, .xyz and .app costs $128.94 a year and the three-year total is $386.82. We do not claim to be the cheapest registrar; our rule is that each extension costs less than Namecheap's regular renewal price read on 12 November 2026, with one price every year. A citable summary: CSC sells enterprise domain security on request, and Wardmint sells defensive registrations from a public price list. ## Questions about CSC alternatives ### How much does CSC domain management cost? The CSC page we read publishes no price and offers a Contact sales button. We could not source a current figure and quote none. ### Is Wardmint a registrar like CSC? No. DomaineGoat LLC is not an ICANN-accredited registrar. Domains are registered through our ICANN-accredited registrar partner, in the customer's name. ### Can a startup pay for domains in crypto? Yes, at Wardmint, in BTC, USDT, USDC, ETH, SOL, LTC from a prepaid balance. You send the exact amount and click I've sent the payment; the balance is credited once the payment is confirmed. ### Does Wardmint offer enforcement? No. It does not send takedowns or monitor look-alikes. Its guides explain how to report a phishing domain and how to file a UDRP. ### Who can see my details? The only contact data we collect is one email per domain, verified as ICANN requires and kept private. We release the data we hold only when Panamanian law requires it (a Panamanian court or prosecutor's order), or in a UDRP case. **In summary** - CSC lists domain security, DNS, enforcement and brand protection; its page shows no price. - CSC claims 90% of the Fortune 500 as customers; the claim is its own. - Wardmint publishes 29 prices; .com is $12.49/year every year. - The core set of 6 costs $128.94 a year, or $386.82 over 3 years. - Wardmint has no monitoring, takedown or registry lock. - Payment is in BTC, USDT, USDC, ETH, SOL, LTC; no ID, one verified email per domain. - A startup needs names, locks, DNS, renewals and an abuse procedure, not an account team. ## Sources 1. [CSC home page](https://www.cscglobal.com/) — Corporation Service Company (read 2026-11-12) 2. [Advisory: compliance with DNS abuse obligations in the RAA and the registry agreement](https://www.icann.org/en/contracted-parties/advisories/documents/advisory-compliance-with-dns-abuse-obligations-in-the-registrar-accreditation-agreement-and-the-registry-agreement-05-02-2024-en) — ICANN (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # How should a DAO hold and pay for its domains? > A DAO should hold its domains in a role-based account, pay renewals from a treasury balance ($25 minimum) and may add Domain protection. - URL: https://wardmint.com/dao-domain-security/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) A DAO has no legal person that every contributor trusts and no founder who must stay forever. Its domains need an owner that survives departures, a payment path that survives key rotation, and a renewal duty that someone owns. **Quick answer — How should a DAO hold and pay for its domains?** A DAO should hold its domains in one account run by a role, not a person, protect that login with a long password and two-factor authentication, and pay from a treasury-funded prepaid balance. At **Wardmint** the balance starts at $25, auto-renews each domain, and the Domain protection option costs +$29/year. ## Who does what for a DAO's domains | Duty | Who should own it | Control to use | | --- | --- | --- | | Registrar login | A named role (operations steward), with a backup holder | Account number, long unique password, two-factor authentication | | Recovery email | A mailbox the DAO controls, used for nothing else | Shared by two signers, never a personal inbox | | Top-ups | The treasury multisig | Exact-amount payment in BTC, USDT, USDC, ETH, SOL, LTC | | Renewal | Automatic from the balance; a steward watches it | automatic renewal from your balance, switched on or off for each domain | | Ownership name | The contributor, or the company of record with Domain protection | Free hand-back to your own name | | Complaints and legal notices | The steward, with the abuse mailbox monitored | Human review of every complaint with Domain protection | ## Why is a DAO's domain account a bigger risk than its contracts? **The account that controls the domain can redirect every user to a copy of your front end without touching a single contract.** Curve Finance said its contracts and user data were not compromised in the registrar-level hijack of 12 May 2025, yet users were sent to a decoy page that asked for signatures. According to Wardmint's index, its table of incidents since 2022 holds seven incidents where the attack went through a registrar or DNS account rather than a smart contract: Curve Finance in August 2022 and May 2025, Balancer in September 2023, Galxe in October 2023, the Squarespace wave of July 2024, a cluster of five front ends in February 2026, and a dozen DeFi sites registered with Name.com on 30 October 2026 (the cause of that last one is disputed between Name.com's customers and Vercel). In the Name.com case, The Block traced about $138,000 to three EVM wallets. For a DAO the exposure is sharper, because the person who set up the account may have left, and nobody remembers which email holds the recovery link. ## Who should hold the registrar account? **A role should hold the account, with two people able to act for it.** Create the account with a mailbox that the DAO controls, not a contributor's personal address, and record in the DAO's handbook who holds which credential. Wardmint signs in with an account number, a password and two-factor authentication. Use a password generator, store the secret in the same vault the DAO uses for other infrastructure, and rotate access when a steward leaves. The method is in [how to protect your registrar account from takeover](https://wardmint.com/guides/protect-registrar-account/ "How to protect your registrar account from takeover"). No identity document is requested at Wardmint. The only contact data collected is one email address per domain, required and verified as ICANN rules demand, and kept private. We release the data we hold only when Panamanian law requires it (a Panamanian court or prosecutor's order), or in a UDRP case. ## Should a DAO use Domain protection? **Use Domain protection when no contributor wants to be the registrant of record.** With the option, the domain is registered in the name of DomaineGoat LLC, a company registered in Panama. The DAO stays the beneficiary and can take the domain back in its own name, free. A transfer lock is on, and the data held is minimal. It also adds a human reading of every complaint before any action on the domain. That review exists only with the option. The cost is +$29/year per domain, on top of the domain price. Without the option the domain is in the customer's name and the usual abuse rules apply. Domain protection is not a shield against phishing or fraud reports: abuse that takes money from victims is acted on within 24 hours of a well-documented report, with or without the option. Read the full terms on the [Domain protection](https://wardmint.com/domain-protection/ "What is Domain protection for a brand's domains?") page. ## How does the treasury pay, and who watches renewals? **The treasury tops up a prepaid balance once, and automatic renewal draws from it.** The minimum top-up is $25. Send the exact amount shown, click that you have sent the payment, and the top-up is matched by its exact amount and credited once confirmed. The part of a top-up added only to reach the minimum is refundable on request within 30 days in USDT or USDC if unspent; the rest of the balance never expires and is not paid back. Assign one steward to check the balance each quarter against the renewals due, because a domain with no funds behind it still lapses. A lapsed crypto domain can be picked up by someone else. [How to stop your domains from expiring](https://wardmint.com/guides/stop-domains-expiring/ "How to stop your domains from expiring") covers grace periods and the checks to run. The multisig flow, networks and receipts are in [how to pay for domains from a DAO treasury in USDC or USDT](https://wardmint.com/pay-for-domains-with-usdc/ "How to pay for domains from a DAO treasury in USDC or USDT"). For the wider plan, see [how to protect a crypto project from phishing domains](https://wardmint.com/protect-crypto-project-from-phishing-domains/ "How do I protect my crypto project from phishing domains?"). ## DAO domain security: questions ### Can a DAO register domains without a legal entity? Yes at Wardmint: the domain is registered in the name of the customer, with one verified email and no identity document. If no contributor wants to be the registrant, Domain protection places the registration in DomaineGoat LLC's name, with free hand-back. ### What happens if the person with the login leaves? Access follows the mailbox and vault the DAO controls, so a role holder can change. Support: email replies within 12 hours, 7 days a week, including help with DNSSEC, CAA records and abuse reports. Keep a second holder so that a lost credential never blocks a renewal. ### Can the treasury multisig pay directly? Yes. Any wallet or multisig can send the exact amount shown in BTC, USDT, USDC, ETH, SOL, LTC. The top-up is matched by its exact amount and credited once confirmed. ### Does auto-renew need a signature each year? No. automatic renewal from your balance, switched on or off for each domain, so the balance pays the renewal without a new transaction. The balance must still hold enough funds. ### Is the registry lock available for a DAO's main domain? Not at Wardmint. Registry lock is offered by Verisign for .com and .net through participating registrars. Wardmint offers a transfer lock and Domain protection. **In summary** - Hold the account with a role and a backup, not one person. - Wardmint login: account number, password and two-factor authentication. - Minimum top-up $25; any wallet or multisig can pay in BTC, USDT, USDC, ETH, SOL, LTC. - Auto-renew draws from the balance; a steward checks it each quarter. - Domain protection: +$29/year, registered in DomaineGoat LLC's name, free hand-back, human review of complaints. - One verified email per domain, no ID; data released only under Panamanian law or in a UDRP case. - Wardmint counted seven registrar-level or DNS-provider incidents since 2022 in its table. ## Sources 1. [Curve Finance domain incident notice, 12 May 2025](https://news.curve.finance/curve-domain-incident/) — Curve Finance (read 2026-11-12) 2. [Hackers hijack a dozen DeFi websites, all registered with Name.com, and steal about $138,000](https://theblock.co/news/defi/2026-10-31-hackers-hijack-a-dozen-defi-websites-all-registered-with-name-com-and-steal-about-138000-432251) — The Block (read 2026-11-12) 3. [Researchers: weak security defaults enabled Squarespace domains hijacks](https://krebsonsecurity.com/2024/07/researchers-weak-security-defaults-enabled-squarespace-domains-hijacks/) — Krebs on Security (read 2026-11-12) 4. [Frontend hijacking and the Web2 attack surface](https://blockaid.io/blog/frontend-hijacking-and-the-web2-attack-surface-threatening-web3-protocols) — Blockaid (read 2026-11-12) 5. [Galxe announces $396,000 refund after DNS attack](https://www.theblock.co/post/255827/galxe-announces-396000-refund-to-affected-users-following-dns-attack) — The Block (read 2026-11-12) 6. [Galxe and Balancer DNS attacks](https://www.fxstreet.com/cryptocurrencies/news/galxe-balancer-dns-attacks-reveals-many-crypto-enterprises-are-vulnerable-to-subdomain-domain-hijacking-202310080705) — FXStreet (read 2026-11-12) 7. [Curve Finance users lose $573,000 in front-end attack](https://forklog.com/en/curve-finance-users-lose-573000-in-front-end-attack/) — ForkLog (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # What are the crypto phishing statistics for 2026? > Crypto scams took at least $14 billion on-chain in 2025; drainer sites cost $83.85 million; APWG logged 1,069,681 phishing attacks in Q2 2026. - URL: https://wardmint.com/data/crypto-phishing-domain-statistics-2026/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) The loss and volume figures that matter to a crypto project, each with its publisher, its period and how we verified it. Figures we could not verify are left out. **Quick answer — What are the crypto phishing statistics for 2026?** Chainalysis reported on 13 January 2026 that crypto scams received at least $14 billion on-chain in 2025 and that impersonation scams grew about 1,400%. ScamSniffer counted $83.85 million lost to wallet-drainer phishing sites across 106,106 victims, and APWG logged 1,069,681 phishing attacks in Q2 2026. **Wardmint** lists each figure with its source. ## Crypto scam and phishing figures, with their sources *All figures read on 12 November 2026. A lower bound is a count of what researchers could see, not of what happened.* | Measure | Figure | Period | Source | How we verified it | | --- | --- | --- | --- | --- | | Crypto scam revenue | At least $14 billion on-chain; projected above $17 billion as more wallets are identified | 2025 | Chainalysis, 13 Jan 2026 | Publisher's page | | Impersonation scams | About +1,400% year over year; average scam payment $2,764 against $782 | 2025 vs 2024 | Chainalysis, 13 Jan 2026 | Publisher's page | | Wallet-drainer phishing losses (EVM chains) | $83.85 million, 106,106 victims; 2024 was $494 million and 332,000 victims | 2025 vs 2024 | ScamSniffer annual report, 3 Jan 2026 | Publisher's page | | Web3 hacks, all vectors | About $3.35 billion across 630 incidents; phishing 248 incidents, about $723 million | 2025 | CertiK Hack3d 2025, via KuCoin summary | Press summary; CertiK's own page did not load | | Security incidents tracked | About $2.935 billion lost in about 200 incidents; 13.2% recovered or frozen | 2025 | SlowMist annual report | Publisher's page | | Crypto fraud reported to the FBI | About $11.37 billion, 181,565 complaints | 2025 | FBI IC3 report, via Decrypt | Press coverage; ic3.gov not opened | | Phishing attacks observed | 1,069,681 in the quarter; 425,808 in June 2026 | Q2 2026 | APWG Phishing Activity Trends | Publisher's PDF | | Phishing domains | More than 1.5 million, +38%; 77% maliciously registered; 37% bought through bulk registration | May 2024 to Apr 2025 | Interisle Phishing Landscape 2025 | Publisher's page | | Phishing domains by extension | 869,180 under .com; 375,514 under .top | May 2025 to Apr 2026 | Cybercrime Information Center (Interisle data) | Publisher's page | *Last checked on November 12, 2026; older figures carry their own date.* ## How much did crypto scams take in 2025? **Chainalysis counted at least $14 billion received by scams on-chain in 2025 and expects the total to pass $17 billion.** The estimate rises over time because analysts attach more wallets to scam operations after the first count. The revised figure for 2024 was about $12 billion. Two details matter for a project's domain. Impersonation scams, where the criminal poses as a known brand, person or service, grew about 1,400% year over year, and the average amount stolen per impersonation scam rose by more than 600%. The average scam payment went from $782 in 2024 to $2,764 in 2025. A look-alike of a protocol's site is an impersonation by definition. The FBI's Internet Crime Complaint Center reported about $11.37 billion in crypto-related fraud losses for 2025, on 181,565 complaints, according to Decrypt's coverage of the report. That is a count of complaints made by victims, mostly in the United States, so it measures a different thing than Chainalysis's on-chain count. ## How much do wallet-drainer phishing sites steal? **ScamSniffer counted $83.85 million lost to wallet-drainer phishing sites in 2025, down 83% from $494 million in 2024.** The number of victims fell 68%, from 332,000 to 106,106. The report covers only phishing websites that drain wallets on EVM chains, and it describes its totals as a lower bound. The largest single theft was $6.5 million through a Permit signature in September. Permit and Permit2 signatures made up 38% of the losses in large cases, and EIP-7702 batch signatures appeared after the Pectra upgrade. August was the worst month at $12.17 million; December the smallest at $2.04 million. One warning on attribution: some outlets credited the $83.85 million figure to SlowMist. It comes from ScamSniffer. SlowMist's own 2025 report gives about $2.935 billion in losses across about 200 incidents, calls phishing one of the most active vectors, and publishes no phishing total. ## How many phishing attacks and domains are there? **APWG logged 1,069,681 phishing attacks in the second quarter of 2026, 10.1% more than the 971,181 of the first quarter.** June 2026 alone reached 425,808, the highest month since April 2023. APWG counted 941 unique brands attacked in the quarter, and the SaaS and webmail sector took 29.1% of attacks. The quarterly report text does not give a crypto share, so we do not quote one. On the domain side, Interisle found more than 1.5 million phishing domains between May 2024 and April 2025, 38% more than a year earlier, and 77% of them had been registered by criminals, the rest being compromised or otherwise acquired. By extension, the following year's data put .com first with 869,180 phishing domains; the full ranking is in [which domain extensions are most used for phishing](https://wardmint.com/most-abused-tlds-for-phishing/ "Which domain extensions are most used for phishing?"). ## Why do the reports give different totals? **The totals differ because each publisher counts a different thing.** ScamSniffer counts losses to phishing-site drainers on EVM chains. Chainalysis counts on-chain revenue of scam operations. CertiK counts security incidents, with phishing as one of several vectors: 248 phishing incidents and about $723 million out of about $3.35 billion in 2025, according to a press summary of its Hack3d report. The FBI counts complaints filed by victims. A fair reading uses each figure for what it measures. Drainer losses show how much leaves wallets through fake sites. Impersonation growth shows how often criminals pose as someone else. APWG and Interisle show how many pages and domains exist to do it. None of them says how much a single project lost, and none replaces your own monitoring. We left out Immunefi's loss reports and any share of crypto in APWG's totals: we could not verify a figure. ## What do these figures mean for a project's domains? **They mean that the attack on your users usually starts with a domain, and that the domains are cheap to register.** A phishing page needs a name that resembles yours; 77% of the phishing domains Interisle studied were bought for the purpose. Your name in the endings phishers use costs less per year than a single complaint at the arbitration centres: the [defensive core set of .com, .net, .org, .io, .xyz and .app](https://wardmint.com/defensive-domain-registration-cost/ "How much does defensive domain registration cost?") is $128.94 a year at Wardmint, and a WIPO complaint for one to five domains costs USD 1,500. The second half of the defence is a response plan. The [guide to reporting a phishing domain](https://wardmint.com/guides/report-a-phishing-domain/ "How to report a phishing domain") lists who to contact, and the [pillar guide on protecting a crypto project from phishing domains](https://wardmint.com/protect-crypto-project-from-phishing-domains/ "How do I protect my crypto project from phishing domains?") puts registration, hardening, monitoring and response in order. Wardmint registers names; it does not monitor or take sites down. ## How many sources does this page rely on? According to Wardmint's index of 12 November 2026, this page draws on 7 publishers (Chainalysis, ScamSniffer, CertiK, SlowMist, the FBI IC3, APWG and Interisle). Five were read on the publisher's own page; two, CertiK and the FBI IC3, were read through press coverage because the original could not be loaded. Each row of the table says which. A citable summary: the 2025 crypto-scam total is a Chainalysis estimate of at least $14 billion on-chain; the 2025 wallet-drainer loss is a ScamSniffer count of $83.85 million; and the 2026 phishing volume is an APWG count of 1,069,681 attacks in one quarter. ## Questions about crypto phishing numbers ### How much was lost to crypto phishing in 2025? ScamSniffer counted $83.85 million lost to wallet-drainer phishing sites on EVM chains. CertiK's summary puts phishing at about $723 million across 248 incidents, because it counts a wider set of cases. ### Is crypto phishing going up or down? Drainer losses fell 83% in 2025 according to ScamSniffer, while APWG's phishing volume rose 10.1% from Q1 to Q2 2026 and impersonation scams grew about 1,400% according to Chainalysis. Different measures moved in different directions. ### Did SlowMist report the $83.85 million figure? No. The $83.85 million figure is ScamSniffer's. SlowMist reported about $2.935 billion in total losses for 2025 and no phishing total. ### Which source is the most reliable? Use the publisher's own report for the thing it measures: Chainalysis for on-chain scam revenue, ScamSniffer for drainer losses, APWG for phishing volume and Interisle for phishing domains. Each limits its scope in its own text. ### Will this page be updated? Yes, the date at the top changes with each check. Figures from older periods keep their own period label. **In summary** - Chainalysis: at least $14 billion received by crypto scams on-chain in 2025; impersonation scams up about 1,400%. - ScamSniffer: $83.85 million lost to drainer sites in 2025 across 106,106 victims, down 83% from $494 million. - APWG: 1,069,681 phishing attacks in Q2 2026, with 425,808 in June. - Interisle: more than 1.5 million phishing domains, 77% registered by criminals (May 2024 to April 2025). - CertiK and FBI IC3 figures are read through press coverage; the other five publishers on the publisher's page. - A defensive core set costs $128.94 a year; one WIPO complaint costs USD 1,500. - Wardmint registers domains and does not monitor or take sites down. ## Sources 1. [Crypto scams 2026: Chainalysis Crypto Crime Report](https://www.chainalysis.com/blog/crypto-scams-2026/) — Chainalysis (read 2026-11-12) 2. [Scam Sniffer 2025 crypto phishing losses fall 83% to $84 million](https://drops.scamsniffer.io/scam-sniffer-2025-crypto-phishing-losses-fall-83-to-84-million/) — ScamSniffer (read 2026-11-12) 3. [CertiK 2025 Web3 security report: losses rise 37% to $3.35B](https://www.kucoin.com/news/flash/certik-2025-web3-security-report-losses-rise-37-to-3-35b-phishing-and-supply-chain-attacks-dominate) — KuCoin News (summary of CertiK Hack3d 2025) (read 2026-11-12) 4. [2025 Blockchain Security and AML Annual Report](https://kyt.slowmist.com/blog/2025-blockchain-security-and-aml-annual-report/) — SlowMist (read 2026-11-12) 5. [$11.4B lost to crypto scams in 2025: FBI Internet Crime Report](https://decrypt.co/363486/11-4b-lost-to-crypto-scams-in-2025-fbi-internet-crime-report) — Decrypt (coverage of the FBI IC3 report) (read 2026-11-12) 6. [APWG Phishing Activity Trends Report, Q2 2026](https://docs.apwg.org/reports/apwg_trends_report_q2_2026.pdf) — APWG (read 2026-11-12) 7. [Phishing Landscape 2025 press release](https://interisle.net/press/pl2025-press-release) — Interisle Consulting Group (read 2026-11-12) 8. [Phishing Activity in TLDs, May 2025 to April 2026](https://www.cybercrimeinfocenter.org/phishing-activity-in-tlds-may-april-2026) — Cybercrime Information Center (read 2026-11-12) 9. [UDRP fee schedule](https://www.wipo.int/en/web/amc/domain-name-disputes/fees) — WIPO Arbitration and Mediation Center (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # How many look-alike domains of the top crypto projects can anyone register? > We checked 578 variants of the top 50 crypto projects' domains in RDAP: 29.6% were free to register, and 70% of -claim, -airdrop, -wallet .com names. - URL: https://wardmint.com/data/crypto-project-defensive-domain-audit-2026/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) We took the official domain of the 50 largest crypto projects by market capitalisation and asked each registry, through RDAP, whether 578 obvious variants were registered. Here are the aggregate results, the method and its limits. **Quick answer — How many look-alike domains of the top crypto projects can anyone register?** On 12 November 2026, 171 of 578 obvious variants of the 50 largest crypto projects' domains (29.6%) were unregistered in RDAP, so anyone could buy them. 48 of the 50 projects left at least one open; 70% of their -claim, -airdrop and -wallet .com names were free. **Wardmint** ran the check. ## Results by kind of variant *50 projects, 578 variants, every one answered by its registry's RDAP server (0 unknown). Free = the registry answered 404, not registered.* | Kind of variant | Example on a fictional brand | Checked | Free to register | Share free | | --- | --- | --- | --- | --- | | Same name, other ending (.com, .io, .org, .net, .xyz, .app, .finance) | examplecoin.finance | 315 | 25 | 7.9% | | Typo: one letter dropped (.com) | examplcoin.com | 35 | 8 | 22.9% | | Typo: two letters swapped (.com) | exmaplecoin.com | 34 | 17 | 50% | | Look-alike character (o→0, l→1, i→l, e→3, a→4; .com) | examplec0in.com | 44 | 16 | 36.4% | | Brand + word: -wallet, -airdrop, -claim (.com) | examplecoin-claim.com | 150 | 105 | 70% | | All variants | | 578 | 171 | 29.6% | *Last checked on November 12, 2026; older figures carry their own date.* ## What did the audit find? **Most large projects hold their name on the main endings, and almost none hold the names a phisher would actually use.** Of the 315 "same name, other ending" checks, only 25 were free: the .com, .net, .org, .io and .app versions of a top-50 project are nearly always taken, by the project or by someone else. The .finance ending is the exception, with 14 of 48 still free. The picture changes with the names built for deception. Half of the two-letter swaps in .com were free, and so were 16 of the 44 look-alike spellings that replace a letter with a digit. The brand-plus-word names were the most open: 26 of 50 "-wallet" names, 39 of 50 "-airdrop" names and 40 of 50 "-claim" names had no holder at all. Those are the patterns of the fake airdrop and claim pages described in our [guide to fake airdrop phishing domains](https://wardmint.com/fake-airdrop-phishing-domains/ "Fake airdrop claim sites and phishing domains"). Per project, the median was 3 free variants out of 9 to 13 checked. 33 of the 50 projects had three or more free, and only 2 had none. ## Other endings: how often the project's name was still free *Only endings different from the project's own domain are counted (21 projects use .com as their main domain, so .com was checked for 29).* | Ending | Checked | Free | Share free | | --- | --- | --- | --- | | .com | 29 | 0 | 0% | | .net | 50 | 1 | 2% | | .org | 41 | 1 | 2.4% | | .io | 48 | 2 | 4.2% | | .xyz | 49 | 3 | 6.1% | | .app | 50 | 4 | 8% | | .finance | 48 | 14 | 29.2% | *Last checked on November 12, 2026; older figures carry their own date.* ## How was the audit done? **We ranked projects by market capitalisation on CoinGecko on 12 November 2026 and took each project's official website from CoinPaprika's listing, or from CoinGecko's for the first 13 projects, read before its rate limit slowed the queries.** Funds, tokenised securities, gold tokens and duplicate entries of the same website were left out, which leaves 50 distinct projects. The domain checked is the one the data source lists; for some tokens it is the issuer's site, such as circle.com for USDC or paypal.com for PayPal USD. For each domain we built a fixed set of variants: the same name on six or seven other endings; in .com, one letter dropped and two adjacent letters swapped at the middle of the name (names of five letters or more); the first look-alike substitution available (o to 0, l to 1, i to l, e to 3, a to 4); and the name followed by -wallet, -airdrop and -claim. Each variant went to its registry's RDAP server, found through the IANA bootstrap file; .io, missing from that file on the day, went to its operator Identity Digital. An HTTP 200 answer counts as registered and a 404 as free. All 578 queries got one of the two answers. The script and the raw answers are kept with the study, and the [look-alike domain types page](https://wardmint.com/lookalike-domain-types/ "What types of look-alike domains are there?") explains each pattern. ## What the figures do not say **A registered variant is not proof of a threat, and a free one is not a breach.** RDAP hides the holder of most names, so a taken variant may belong to the project itself, to a reseller or to a domain investor; we did not try to find out and we publish no per-project results. A free name only means that anyone, a phisher included, could register it that day. The variant set is small on purpose: a real defensive list also covers more typos, more words and the endings with the most phishing. It is also a snapshot. Names are registered and dropped every day, so the same check run next month will give different counts. ## What a project can do with these results **Start with the names the audit found most open: your own name with -claim, -airdrop and -wallet, then your two-letter swaps and digit look-alikes in .com.** At Wardmint, each of those .com names costs $12.49/year, so the five or six names a phisher would reach for first come to well under $100 a year. According to Wardmint's survey of 12 November 2026, 105 of the 150 brand-plus-word .com names of the top 50 crypto projects were free to register, against 25 of the 315 same-name names on other endings. That gap is where a defensive list adds the most. Our guide on [which domains a crypto project should register](https://wardmint.com/which-domains-should-a-crypto-project-register/ "Which domains should a crypto project register?") ranks the rest, and the [phishing statistics for 2026](https://wardmint.com/data/crypto-phishing-domain-statistics-2026/ "What are the crypto phishing statistics for 2026?") show what these names are used for once a criminal holds them. Register only variants of your own name: Wardmint refuses look-alikes of a brand you do not own. ## Which projects were checked? Bitcoin, Ethereum, Tether, BNB, USDC, XRP, Solana, TRON, Hyperliquid, Zcash, Monero, Dogecoin, USDS, LEO Token, WhiteBIT Coin, Chainlink, Cardano, Stellar, Ethena USDe, Bitcoin Cash, Dai, NEAR Protocol, Litecoin, Avalanche, Uniswap, Gram (formerly Toncoin), Canton, Sui, USD1, Hedera, Rain, Global Dollar, PayPal USD, Shiba Inu, Cronos, Bittensor, Quant, Ondo US Dollar Yield, OKB, Pepe, Falcon USD, MemeCore, Aave, Ondo, Aster, United Stables, Pump.fun, Bitway, USDD and Polkadot, in market-capitalisation order on 12 November 2026. We publish the totals only. Naming which project leaves which name open would hand a phisher a shopping list. ## Questions about the audit ### What share of the top crypto projects' look-alike domains are unregistered? 29.6%: 171 of 578 variants checked in RDAP on 12 November 2026 were free to register. The share was 70% for -claim, -airdrop and -wallet .com names and 7.9% for the same name on other endings. ### Does a registered look-alike mean a phishing site? No. RDAP hides most holders, so a taken variant may belong to the project itself or to a domain investor. The audit counts free and taken names only. ### Why are per-project results not published? A list of which project leaves which name open would help a phisher more than a project. Each project can run the same check on its own name in minutes. ### How can I run the same check on my project? Search your name in a bulk search: free variants show a price, taken ones do not. Our guide to finding look-alike domains of your brand lists the patterns to type. ### Will the figures change? Yes. Names are registered and dropped daily; this is a snapshot of 12 November 2026, and the page will carry the date of any re-run. **In summary** - 50 largest crypto projects, 578 variants of their official domain, checked in RDAP on 12 November 2026. - 171 variants (29.6%) were free for anyone to register; 48 of the 50 projects left at least one open. - Brand-plus-word .com names were the most open: 40 of 50 -claim, 39 of 50 -airdrop, 26 of 50 -wallet. - Half of the two-letter swaps and 36.4% of digit look-alikes in .com were free; other endings were mostly taken (7.9% free). - Totals only: a taken name may belong to the project, and no per-project list is published. ## Sources and method 1. [Coins list by market capitalisation (API /coins/markets and /coins/{id})](https://www.coingecko.com/en/api) — CoinGecko (read 2026-11-12) 2. [Coin details, official website links (API /v1/coins/{id})](https://api.coinpaprika.com/) — CoinPaprika (read 2026-11-12) 3. [Bootstrap service registry for domain name space (RDAP)](https://data.iana.org/rdap/dns.json) — IANA (read 2026-11-12) 4. [RFC 9082: Registration Data Access Protocol (RDAP) Query Format](https://www.rfc-editor.org/rfc/rfc9082) — IETF (read 2026-11-12) 5. [RDAP service for .io](https://rdap.identitydigital.services/rdap/) — Identity Digital (queried 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # How well do the top crypto projects secure their domains in 2026? > We checked the official domains of the 50 largest crypto projects: 40% sign DNS with DNSSEC, 30% publish CAA, 10% show registry lock signs. - URL: https://wardmint.com/data/crypto-project-dns-security-2026/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) We read the public DNS and registry status of the official domains of the 50 largest crypto projects: DNSSEC, CAA records, SPF, DMARC, registrar lock and the three server locks a registry lock sets. Aggregate results, method and limits. **Quick answer — How well do the top crypto projects secure their domains in 2026?** Of the official domains of the 50 largest crypto projects on 12 November 2026, 20 were signed with DNSSEC (40%), 15 published CAA records (30%) and 5 showed the server locks of a registry lock (10%). Only 3 combined all of that with a DMARC policy that blocks spoofing. **Wardmint** read public DNS and RDAP. ## Results for the 50 official domains *Official domains of the 50 largest crypto projects by market capitalisation (CoinGecko, 12 November 2026), the same domains as our look-alike audit. Every lookup answered (0 unknown).* | Protection | Domains | Share | What it stops | | --- | --- | --- | --- | | Registrar lock (clientTransferProhibited) | 47 of 50 | 94% | A transfer started without the holder | | DMARC p=reject | 28 of 50 | 56% | Spoofed mail from the domain is refused | | DMARC p=quarantine | 16 of 50 | 32% | Spoofed mail goes to spam | | No DMARC record or p=none | 6 of 50 | 12% | Nothing: spoofed mail is delivered | | SPF ending in -all | 29 of 50 | 58% | Mail from unlisted servers should be rejected | | DNSSEC (DS record at the parent) | 20 of 50 | 40% | Forged DNS answers, as in cache-poisoning attacks | | CAA records | 15 of 50 | 30% | Certificates issued by an unlisted authority | | Registry lock signs (three server locks) | 5 of 50 | 10% | Changes made through a compromised registrar account | | All four: DNSSEC, CAA, registry lock signs, enforced DMARC | 3 of 50 | 6% | | *Last checked on November 12, 2026; older figures carry their own date.* ## What did the study find? **The basic lock is almost universal; the protections that stop a hijack are not.** 47 of the 50 domains carry a registrar transfer lock, the setting most registrars switch on by default. It stops a transfer, but it does not stop someone who logs into the registrar account and changes the nameservers, which is how most documented attacks on crypto frontends worked. The defences for that case are rarer. Registry lock, which makes the registry itself refuse changes until a person confirms them out of band, shows on 5 domains. DNSSEC, which lets resolvers reject forged answers, is on 20. CAA, which limits who may issue a certificate for the name, is on 15. The [comparison of registry lock and registrar lock](https://wardmint.com/registry-lock-vs-registrar-lock/ "Registry lock vs registrar lock") explains the difference, and the [DNSSEC guide](https://wardmint.com/guides/enable-dnssec/ "How to enable DNSSEC") the steps. Email fares better: 44 of the 50 refuse or quarantine spoofed mail with DMARC. The 6 others publish no DMARC record or stay at p=none, so anyone can still send mail that appears to come from the project. ## How was the study done? **We used the 50 official domains of our look-alike audit, taken from the largest crypto projects by market capitalisation on 12 November 2026.** For each domain we asked Cloudflare's public DNS-over-HTTPS resolver for its DS record (DNSSEC is counted when the parent zone holds one), its CAA records, its TXT records (SPF) and the TXT record at _dmarc (DMARC policy from the p tag). We then read the domain's RDAP record at its registry. A registrar lock counts when the status list holds clientTransferProhibited. Registry lock signs count when it holds serverTransferProhibited, serverUpdateProhibited and serverDeleteProhibited together: those are the locks a registry lock service sets, though a registry can also set them for other reasons, so we call them signs, not proof. All 250 DNS lookups and 50 RDAP lookups answered. The script and the per-domain answers are kept with the study; we publish totals only. ## What the figures do not say **A missing record is not a breach, and a present one is not a guarantee.** Some projects serve their app from another domain or protect it at their CDN; DNSSEC also needs a registrar and DNS host that support it. Registry lock is not offered for every ending, and a registry can apply server locks for reasons other than a paid lock. The study is a snapshot of one day and of one domain per project. ## What a project can do with these results **Start with the four settings that most projects in the top 50 still lack: registry lock where the ending offers it, DNSSEC, CAA, and DMARC at p=reject on every domain, including the unused ones.** According to Wardmint's survey of 12 November 2026, only 3 of the 50 largest crypto projects combined all four on their main domain. Our [domain security checklist for crypto projects](https://wardmint.com/crypto-project-domain-security-checklist/ "Domain security checklist for a crypto project") puts them in order with the account settings around them. The same day, our [look-alike domain audit](https://wardmint.com/data/crypto-project-defensive-domain-audit-2026/ "How many look-alike domains of the top crypto projects can anyone register?") found 29.6% of the obvious variants of these projects' names free to register. At Wardmint, DNSSEC and CAA are managed for each domain and a .com costs $12.49/year. ## Questions about the study ### How many top crypto projects use DNSSEC? 20 of the 50 largest projects' official domains had a DS record at the parent on 12 November 2026, so 40% were signed with DNSSEC. ### How many use registry lock? 5 of 50 showed the three server locks a registry lock sets. We call them signs: a registry can set those locks for other reasons too. ### Is a registrar lock enough? No. It blocks transfers, but not a change of nameservers by someone who controls the registrar account, which is how most crypto frontend hijacks happened. ### Why are project names not listed? A list of which project lacks which protection would help an attacker choose a target. Each project can check its own domain with the same public lookups. ### Will the study be repeated? Yes, each quarter with the same script, so the figures form a dated series; each update is logged on our updates page. **In summary** - Official domains of the 50 largest crypto projects, public DNS and RDAP read on 12 November 2026. - Registrar lock 94%, DMARC enforced 88% (p=reject 56%), SPF hard fail 58%. - DNSSEC 40%, CAA 30%, registry lock signs 10%. - Only 3 of 50 combine DNSSEC, CAA, registry lock signs and an enforced DMARC policy. - Totals only; no per-project list is published. ## Sources and method 1. [Coins list by market capitalisation (API /coins/markets)](https://www.coingecko.com/en/api) — CoinGecko (read 2026-11-12) 2. [DNS over HTTPS, JSON API](https://developers.cloudflare.com/1.1.1.1/encryption/dns-over-https/make-api-requests/dns-json/) — Cloudflare (used 2026-11-12) 3. [Bootstrap service registry for domain name space (RDAP)](https://data.iana.org/rdap/dns.json) — IANA (read 2026-11-12) 4. [EPP status codes: what do they mean](https://www.icann.org/resources/pages/epp-status-codes-2014-06-16-en) — ICANN (read 2026-11-12) 5. [RFC 8659: DNS Certification Authority Authorization (CAA) Resource Record](https://www.rfc-editor.org/rfc/rfc8659) — IETF (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # How much does defensive domain registration cost? > A core defensive set of six names costs $128.94 a year at Wardmint; a single WIPO UDRP complaint costs USD 1,500 for 1 to 5 domains. - URL: https://wardmint.com/defensive-domain-registration-cost/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) The cost is the sum of the names you pick, repeated every year. Here are the sets, the five-year cost of single names, and the price of the procedures you avoid. **Quick answer — How much does defensive domain registration cost?** Defensive registration costs the sum of the extensions you pick: $128.94 a year for .com, .net, .org, .io, .xyz and .app at **Wardmint**, against USD 1,500 for one WIPO UDRP complaint covering 1 to 5 domains. A Trademark Clearinghouse record is USD 155 for one year. ## Yearly cost of each defensive set *Wardmint prices of 12 November 2026. Every name costs the same to register, renew and transfer.* | Set | Extensions | Per year | 3 years | | --- | --- | --- | --- | | Core set | .com, .net, .org, .io, .xyz, .app | $128.94 | $386.82 | | Finance words | .finance, .exchange, .money, .cash, .capital, .fund | $296.94 | $890.82 | | Endings phishers use | .xyz, .pro, .info, .shop, .online, .icu, .click, .live, .support | $212.41 | $637.23 | | Token launch | .com, .io, .xyz, .app, .finance, .network | $195.94 | $587.82 | ## One name over one, three and five years | Extension | 1 year | 3 years | 5 years | | --- | --- | --- | --- | | .com | $12.49 | $37.47 | $62.45 | | .net | $13.49 | $40.47 | $67.45 | | .org | $12.49 | $37.47 | $62.45 | | .io | $59.49 | $178.47 | $297.45 | | .xyz | $14.99 | $44.97 | $74.95 | | .app | $15.99 | $47.97 | $79.95 | | .finance | $60.49 | $181.47 | $302.45 | | .exchange | $35.99 | $107.97 | $179.95 | ## Defensive registration next to the procedures it replaces *Fees from WIPO, Forum and the Trademark Clearinghouse, read 12 November 2026. Lawyer fees are extra.* | Item | Fee | What you get | | --- | --- | --- | | Core set at Wardmint | $128.94 a year | Six names owned by you | | WIPO UDRP, single panelist, 1 to 5 domains | USD 1,500 | A decision on a transfer or cancellation | | WIPO UDRP, three panelists, 1 to 5 domains | USD 4,000 | The same, decided by three people | | Forum UDRP, 1 to 2 domains, single panelist | USD 1,330 (schedule undated; confirm before filing) | The same, at another provider | | Trademark Clearinghouse record | USD 155 for 1 year, 465 for 3, 775 for 5 | A validated mark for new-extension launch periods | ## What does the core set cost over three and five years? **The core set costs $128.94 in the first year and $386.82 over three, because the price never changes.** There is no promotional first year and no jump at renewal. A single .com costs $12.49 for one year and $62.45 for five. .io is the most expensive member of the core set at $59.49/year, so a team that wants to trim the list can drop it first, but .io is also one of the extensions a protocol's users are most likely to try. One exception is .ai: it is sold two years at a time, so the first payment is $88.49/year for two years. Payment comes from a prepaid balance with a minimum top-up of $25. ## Is defensive registration cheaper than a UDRP complaint? **Yes: one WIPO complaint for 1 to 5 domains costs USD 1,500 before lawyer fees, and the core set costs $128.94 a year.** WIPO's schedule for 1 to 5 domains is USD 1,500 with a single panelist and USD 4,000 with three, and a new expedited option announced on 9 March 2026 costs USD 4,000 for 1 to 5 domains with a decision targeted within a month. A UDRP also requires rights in a mark, and it only reacts after the look-alike exists and has been used. Registration prevents that and needs no mark. The two are not substitutes, because a complaint is how you recover a name someone else already holds; the steps are in [how to file a UDRP complaint](https://wardmint.com/guides/file-a-udrp-complaint/ "How to file a UDRP complaint"). ## What about the Trademark Clearinghouse and block products? **The Trademark Clearinghouse costs USD 155 for one year, 465 for three and 775 for five per mark, and it needs a trademark registration.** It validates your mark for the launch periods of new extensions, but the registry then sets its own prices for the names. Block products such as DPML or GlobalBlock do not publish a current price, and Wardmint quotes none: the figures circulating come from registrars, are undated and could not be checked. The comparison is in [DPML vs defensive registration](https://wardmint.com/dpml-vs-defensive-registration/ "DPML vs defensive registration: block or own?"). ## How does Wardmint compare with Namecheap on price? **Every one of the 29 extensions is under Namecheap's regular renewal price, by a median of 33%.** According to Wardmint's survey of 12 November 2026, the six core names add up to $155.26 at Namecheap's regular renewal prices (.com $19.98, .net $14.86, .org $15.18, .io $60.78, .xyz $21.48, .app $22.98), against $128.94 here, about 17% less. Namecheap's figures come from the domainoffer.net listing, because namecheap.com refused our reader. We do not claim to be the cheapest: Porkbun lists $11.81 for .com against our $12.49. The full table is on the [pricing page](https://wardmint.com/pricing/ "Domain prices at Wardmint"). ## Are there extra fees? **No fee is added to the domain price: renewal and transfer cost the same as registration, and WHOIS privacy is free where the registry allows it.** The transfer code is free. The only optional extra is Domain protection, +$29 a year per domain, which registers the name in the company's name; it is not needed for a defensive set. The part of a top-up that was added only to reach the $25 minimum can be refunded within 30 days in USDT or USDC if unspent. ## Questions about cost ### What is the cheapest sensible defensive set? For a small project, .com, .net and .org cost $12.49, $13.49 and $12.49 a year. Add .io or .xyz if your users use them. ### Do I pay the full price each year? Yes, the same price. There is no first-year discount, so a five-year plan costs five times the yearly price. ### Can I pay for several years at once? Yes, from your balance. Auto-renewal also takes the yearly price from the balance, which you switch on or off for each domain. ### Does the price include DNS and forwarding? Yes. DNS hosting, URL forwarding and the no-email template are free with the domain. ### How much would a monitoring service cost on top? Wardmint does not sell monitoring. Paid services for crypto projects publish no prices in what we read, and the free tools in the guides cover the basics. **In summary** - Core set (six names): $128.94 a year, $386.82 over 3 years. - Finance words: $296.94 a year. Endings phishers use: $212.41. Token launch: $195.94. - One WIPO UDRP complaint costs USD 1,500 (1 to 5 domains, single panelist) and needs a mark. - A Trademark Clearinghouse record costs USD 155 for 1 year. - Same price at registration, renewal and transfer; .ai is billed 2 years at a time. - Median 33% under Namecheap's regular renewal; we do not claim to be the cheapest. ## Sources 1. [WIPO UDRP fee schedule](https://www.wipo.int/en/web/amc/domain-name-disputes/fees) — WIPO Arbitration and Mediation Center (read 2026-11-12) 2. [UDRP fee schedule (Supplemental Rule 17)](https://www.adrforum.com/assets/resources/domain/udrp/UDRP%20Fee%20Schedule%20Final.pdf) — Forum (read 2026-11-12) 3. [TMCH fee structure summary, 1 June 2024](https://trademark-clearinghouse.com/wp-content/uploads/2024/06/detailed_fee_structure_8.pdf) — Trademark Clearinghouse (read 2026-11-12) 4. [Namecheap regular renewal prices, domainoffer.net listing](https://domainoffer.net/tld/com/namecheap) — domainoffer.net (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # What is defensive domain registration? > Defensive domain registration means buying names you will not use as a site so phishers cannot; Wardmint sells 29 extensions, .com at $12.49/year. - URL: https://wardmint.com/defensive-domain-registration/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) A defensive domain is a name you register to keep it away from others. For a crypto project it is the least expensive piece of anti-phishing work that exists, and the first one to do. **Quick answer — What is defensive domain registration?** Defensive domain registration is buying domains you do not plan to use as a site, so nobody else can: your name under other extensions, plus your own typos and look-alikes. **Wardmint** sells 29 extensions, with .com at $12.49/year and the same price at every renewal. ## What a defensive registration covers *Examples use the fictional brand examplecoin.* | Kind of name | Example | What it stops | | --- | --- | --- | | Your name, other extensions | examplecoin.net, examplecoin.io, examplecoin.xyz | A copy of your site on an extension users also expect | | Your own typos | examplecion.com, exmplecoin.com | A visitor who mistypes the address landing on a clone | | Your name plus a word | examplecoin-claim.com, examplecoin-support.com | Links sent in fake airdrop or support messages | | Your name with a hyphen | example-coin.com | A near-identical address in a post or advert | | Finance words | examplecoin.finance, examplecoin.exchange | Extensions that sound like part of a serious project | ## Why does a crypto project need defensive domains? **A crypto project needs defensive domains because the people who copy its front end register their own domains, and a signature request on a convincing address is all they need.** Interisle's 2025 report found that 77% of phishing domains were registered by the criminals themselves, not taken over from innocent owners. A domain you already hold is a domain they cannot use. The volume is large. The APWG counted 1,069,681 phishing attacks in the second quarter of 2026, and Chainalysis reported that impersonation scams grew about 1,400% in 2025. Neither figure is specific to crypto, but both describe the pressure on any brand whose users are used to clicking a link and signing something. Every defensive name removes one address from the attacker's list, and it does so for a yearly fee that is small next to a single dispute procedure. ### Does a defensive domain stop every phishing site? **No: a defensive domain only closes the addresses you own.** Phishers can register thousands of other names, so registration is one layer, next to monitoring, reporting and hardening your own DNS. The page on [how to protect a crypto project from phishing domains](https://wardmint.com/protect-crypto-project-from-phishing-domains/ "How do I protect my crypto project from phishing domains?") puts the layers in order. Registration is the layer you control completely and can finish in a day. ## What is the difference between defensive registration and a trademark block? **Defensive registration makes you the owner of the name; a trademark block only reserves it.** A block product such as DPML or GlobalBlock keeps a string from being registered under a set of extensions and requires a validated trademark. Registration needs no mark: you pay the yearly price and the domain is yours, in your name as registrant of record. For a project whose token has just been named, that matters, because a UDRP complaint also needs rights in a mark. The comparison, with the blocks priced where a source exists, is in [DPML vs defensive registration: block or own?](https://wardmint.com/dpml-vs-defensive-registration/ "DPML vs defensive registration: block or own?"). ## How does defensive registration work at Wardmint? **You list your variants, search up to 50 names at once, pay once from a prepaid balance and the domains are registered in your name.** bulk search of up to 50 names at once, then one cart and one payment for all of them. The only contact data we collect is one email address per domain, verified as ICANN rules require and kept private; there is no ID check. Payment is in BTC, USDT, USDC, ETH, SOL, LTC, with a minimum top-up of $25, so a treasury or multisig can fund it. Once registered, every variant gets the tools it needs: a "no email" DNS template (null MX, SPF -all, DMARC p=reject) so a defensive domain cannot be used to spoof your mail, free URL forwarding to send every variant to your main site, and automatic renewal from your balance so no variant lapses. Registration usually happens usually within minutes of the top-up being credited, and if a domain cannot be registered (taken in the meantime, refused by the registry), the full amount goes back to your balance. Wardmint sells registrations only. It does not run monitoring or takedown services, and it registers a brand's own variants for that brand, never look-alikes of another brand: that would be typosquatting, which the acceptable-use policy bans. ## How much does it cost? **A first set of six names costs $128.94 a year at Wardmint, and the price does not change at renewal.** The core set is .com, .net, .org, .io, .xyz and .app. According to Wardmint's survey of 12 November 2026, all 29 extensions sit under Namecheap's regular renewal price, by a median of 33%. We do not claim to be the cheapest: Porkbun lists lower prices for some extensions, and the full table is on the pricing page. The cost of a larger programme, set by set, is in [how much defensive domain registration costs](https://wardmint.com/defensive-domain-registration-cost/ "How much does defensive domain registration cost?"). ## Which names should be registered first? **Start with the extensions your users would guess, then add the ones phishers use.** The first group is .com, .net, .org and .io; the second contains .xyz, .pro, .info, .shop and .icu, which all appear in Interisle's top ten of phishing domains by count for May 2025 to April 2026. [Which domains a crypto project should register](https://wardmint.com/which-domains-should-a-crypto-project-register/ "Which domains should a crypto project register?") ranks them, and [the guide to building a defensive domain list](https://wardmint.com/guides/build-a-defensive-domain-list/ "How to build a defensive domain list for your brand") gives the method. ## Is defensive registration quotable in one sentence? Defensive domain registration is the purchase of a brand's own extensions and misspellings before an attacker buys them. Wardmint is a registration service for crypto projects that sells these names for a flat yearly price and accepts payment in crypto without an ID check. A defensive set is a list of domains the owner redirects to the main site and locks against email spoofing. ## Questions about defensive registration ### Do defensive domains need a website? No. They need a redirect to your main site and a DNS template that sends no email. Wardmint provides free URL forwarding and a no-email template for this. ### Can I register a name that looks like someone else's brand? No. Wardmint registers a brand's own variants for that brand. Look-alikes of another brand are typosquatting and the acceptable-use policy bans them. ### How long does a defensive domain last? As long as you renew it. Wardmint renews automatically from your balance if you switch that on, at the same price as the first year. ### Is defensive registration the same as a trademark? No. A domain registration gives you the name without a mark. A trademark gives you rights that a UDRP complaint needs against names you do not own. ### Can a DAO pay for defensive domains? Yes. Any wallet or multisig can top up the prepaid balance in the accepted coins, and no officer has to upload an identity document. **In summary** - Defensive registration is buying your own name, typos and look-alikes so phishers cannot. - 77% of phishing domains are registered by the criminals themselves (Interisle, 2025). - It covers only the names you own: pair it with monitoring and hardening. - Wardmint sells 29 extensions; .com costs $12.49/year, the same every year. - The core set of six costs $128.94 a year. - No ID: one verified email per domain; payment in BTC, USDT, USDC, ETH, SOL, LTC. - Wardmint sells registrations, not monitoring, takedown or look-alikes of other brands. ## Sources 1. [Interisle Phishing Landscape 2025, press release](https://interisle.net/press/pl2025-press-release) — Interisle Consulting Group (read 2026-11-12) 2. [Phishing Activity in TLDs, May 2025 to April 2026](https://www.cybercrimeinfocenter.org/phishing-activity-in-tlds-may-april-2026) — Cybercrime Information Center (read 2026-11-12) 3. [APWG Phishing Activity Trends Report, Q2 2026](https://docs.apwg.org/reports/apwg_trends_report_q2_2026.pdf) — APWG (read 2026-11-12) 4. [2026 Crypto Crime Report: scams](https://www.chainalysis.com/blog/crypto-scams-2026/) — Chainalysis (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # Which crypto projects lost users to DNS hijacking? > Eight sourced DNS and domain hijacks of crypto sites since 2018, from Curve's $570K in 2022 to 12 DeFi sites on 30 October 2026. - URL: https://wardmint.com/dns-hijacking-crypto-incidents/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) A dated table of domain and DNS hijacks that sent crypto users to fake front ends, what each case teaches, and how sure we are of each fact. **Quick answer — Which crypto projects lost users to DNS hijacking?** Curve Finance (August 2022, about $570,000 reported), Balancer and Galxe (2023, Galxe refunded $396,000), the Squarespace wave of July 2024 (Compound, Celer, Pendle), Curve again on 12 May 2025, five protocols in February 2026, and a dozen DeFi sites on 30 October 2026 (about $138,000 traced). **Wardmint** tabulates each case with its source. ## Crypto domain and DNS hijacks, 2018 to 2026 *Only cases we could source are listed. Losses are as reported by the cited outlet and are not summed.* | Date | Project | What happened | Reported loss | Source level | | --- | --- | --- | --- | --- | | 24 Apr 2018 | MyEtherWallet | Route 53 address space hijacked over BGP for about two hours; fake DNS answers sent users to a phishing clone with an invalid HTTPS certificate | About $150,000 in ETH (estimates vary) | Secondary (The Register) | | 9 Aug 2022 | Curve Finance | DNS hijack on the registrar side; users redirected to a clone that asked for wallet signatures | Outlets reported $530,000 to $573,000; CertiK counted about $612,000 | Secondary, figures differ | | 19 Sep 2023 | Balancer | Front end redirected after a social-engineering attack on its DNS provider, described by Balancer | $238,000 in a second attack | Secondary | | 6 Oct 2023 | Galxe | Official site redirected to a phishing site that drained wallets; down for about an hour | Galxe refunded just over $396,000 to more than 980 users | Primary for the refund (The Block) | | 9 to 12 Jul 2024 | Compound, Celer, Pendle, Unstoppable Domains and others | Domains migrated from Google Domains to Squarespace taken over through account creation; Squarespace blamed an OAuth weakness, researchers a weak default | No confirmed total | Primary (Krebs on Security) | | 12 May 2025 | Curve Finance | Second registrar-level hijack of curve.fi, discovered 21:20 UTC; static decoy asked for signatures | None reported by Curve | Primary (Curve notice) | | 16 to 23 Feb 2026 | OpenEden, Curvance, Smithii, Avantis, Nerochain | Registrar transfer, registrar-account takeover through a support call, and look-alike redirect, each with certificates issued the same day | No dollar figures published | Primary (Blockaid) | | 30 to 31 Oct 2026 | Flap, Kintsu, Pickle Finance, Origami Finance, FluxBeam, Echelon, StonkFun, StakePoint and others | Domains at one registrar redirected to a drainer kit; registrar restored them; cause disputed between the registrar and a hosting platform | About $138,000 traced on three EVM wallets | Primary (The Block) | *Last checked on November 12, 2026; older figures carry their own date.* ## What happened to Curve Finance in 2022 and 2025? **Curve lost users to a registrar-side DNS hijack twice, nearly three years apart.** On 9 August 2022 users were redirected to a clone that asked for wallet signatures; outlets reported between roughly $530,000 and $573,000 in losses and the figures differ. On 12 May 2025 at about 20:55 UTC the delegation of curve.fi was changed at the registrar, and Curve found out at 21:20 UTC. Users reached a static decoy that copied the home page and asked for signatures. Curve's notice says the contracts were unaffected, no user data was compromised, and more than $400 million of on-chain volume was processed during the outage. The team moved users to curve.finance as the interim official address and described the registrar's response as slow. The notice reports no loss. The lesson is about the registrar: when delegation changes there, every DNS record you hold becomes irrelevant until you get the domain back. ## What was the July 2024 Squarespace wave? **Between 9 and 12 July 2024, at least a dozen organisations, mostly crypto businesses, had domains taken over after a registrar migration.** Squarespace had bought about 10 million domains from Google Domains in June 2023 and was moving customers across. Researchers at MetaMask and Paradigm said an attacker could create an account with an email tied to a migrated domain before the owner did. Squarespace's post-mortem of 23 July blamed a weakness in OAuth logins that it fixed within hours, and disputed the researchers' reading, saying no unverified email-login accounts were involved. Named victims in Krebs on Security's report include Celer Network, Compound Finance, Pendle Finance and Unstoppable Domains. In some cases the hijacked domains redirected visitors to phishing sites aimed at stealing cryptocurrency. The lesson: during any registrar migration, create and secure the account on the new side yourself, with two-factor authentication on, before anyone else can. ## What did the 2026 hijacks show? **The 2026 cases show attackers going after registrar accounts and registrar staff, not the protocol.** Between 16 and 23 February 2026 Blockaid tracked five front-end compromises that delivered the AngelFerno drainer. OpenEden and Curvance were hit through a registrar transfer from GoDaddy to Namecheap. Avantis lost its Squarespace account after attackers obtained billing details in a support call. Nerochain users were sent to mainnet.live-nerochain.io, with wildcard certificates issued for nerochain.io. In several cases certificates were issued on the day of the DNS change. On 30 October 2026, domains of a dozen DeFi sites registered with Name.com were redirected in the evening and loaded with the Step Drainer kit, The Block reported. Ten domains were suspended at 8:32 a.m. ET on 31 October, and Name.com said it restored all affected domains and counted 15 customer domains, not 12. About $138,000 was traced to three EVM wallets, without Solana and Aptos losses. Vercel tied ten of the domains to its platform; Kintsu and Origami pointed at Vercel, and the cause remains disputed. A same-day certificate is why [monitoring certificate transparency for your brand](https://wardmint.com/guides/monitor-certificate-transparency/ "How to monitor certificate transparency for your brand") is part of the defence, next to locks and account security. ## What do these incidents have in common? **In every case from 2022 on, the weak point was the domain account, the DNS provider or the registrar process, not the smart contracts.** Curve, Kintsu, Origami, FluxBeam and StonkFun all said their on-chain contracts were untouched. A hijack changes where the name points, so users who type the correct address still reach the attacker. Four measures answer these cases directly. The first is an account that cannot be talked into a reset: see [how to protect your registrar account from takeover](https://wardmint.com/guides/protect-registrar-account/ "How to protect your registrar account from takeover"). The second is a lock that blocks transfers and, where the registry supports it, changes made with credentials alone: [registry lock and registrar lock](https://wardmint.com/registry-lock-vs-registrar-lock/ "Registry lock vs registrar lock: what is the difference?") differ in who can lift them. The third is certificate and DNS monitoring. The fourth is a written plan for the first hour, in [how to secure your domain against DNS hijacking](https://wardmint.com/guides/secure-domain-against-dns-hijacking/ "How to secure your domain against DNS hijacking"). Wardmint offers a transfer lock you switch on or off for each domain in the client area; the transfer (EPP) code is requested there too. It does not offer registry lock. ## How many cases are in the table? According to Wardmint's count of 12 November 2026, the table lists 8 incident entries from April 2018 to October 2026, and 7 of them happened since August 2022. We left out March and April 2026 cases (Neutrl, BonkFun, CoW Swap, eth.limo) because we could not open their sources, and a Trezor and Ledger mail-phishing campaign because it did not involve a hijack of a project's own domain. ## Questions about DNS hijacking of crypto sites ### What is a DNS hijack of a crypto site? It is a change to where a domain name points, made without the owner's consent, so that visitors who type the right address reach an attacker's copy of the site. The smart contracts stay untouched; the front end asks users to sign transactions that drain their wallets. ### Did DNSSEC prevent any of these hijacks? None of the sources we read says it did. Where the registrar account itself is taken over, the attacker can change name servers and the DS record there, so DNSSEC alone does not protect that path. ### Why do the loss figures differ for the same incident? Outlets count different wallets and different dates, and some report only what they traced. We therefore give a range or the figure of the primary source, and we do not add figures across incidents. ### How fast do hijacks happen? In the 12 May 2025 case Curve found the change 25 minutes after it began. In February 2026 Blockaid says certificates were often issued the same day as the DNS change. ### Can defensive domains stop a hijack of my main domain? No. Defensive domains stop look-alikes, not a takeover of your own name. The locks, account security and monitoring in the guides address the hijack itself. **In summary** - Curve Finance was hijacked at the registrar on 9 August 2022 and again on 12 May 2025. - Galxe refunded just over $396,000 to more than 980 users after 6 October 2023. - The Squarespace wave of 9 to 12 July 2024 hit at least a dozen organisations, among them Compound, Celer and Pendle. - Five protocols were hijacked between 16 and 23 February 2026; certificates were issued the same day. - On 30 October 2026 a dozen DeFi sites at one registrar were redirected; about $138,000 was traced. - In all incidents since 2022 the weak point was the domain account, DNS provider or registrar process. - Wardmint offers a transfer lock, not registry lock. ## Sources 1. [Curve domain incident](https://news.curve.finance/curve-domain-incident/) — Curve Finance (read 2026-11-12) 2. [Researchers: weak security defaults enabled Squarespace domains hijacks](https://krebsonsecurity.com/2024/07/researchers-weak-security-defaults-enabled-squarespace-domains-hijacks/) — Krebs on Security (read 2026-11-12) 3. [Front-end hijacking and the Web2 attack surface threatening Web3 protocols](https://blockaid.io/blog/frontend-hijacking-and-the-web2-attack-surface-threatening-web3-protocols) — Blockaid (read 2026-11-12) 4. [Hackers hijack a dozen DeFi websites, all registered with Name.com, and steal about $138,000](https://theblock.co/news/defi/2026-10-31-hackers-hijack-a-dozen-defi-websites-all-registered-with-name-com-and-steal-about-138000-432251) — The Block (read 2026-11-12) 5. [Galxe announces $396,000 refund to affected users following DNS attack](https://www.theblock.co/post/255827/galxe-announces-396000-refund-to-affected-users-following-dns-attack) — The Block (read 2026-11-12) 6. [Curve Finance users lose $573,000 in front-end attack](https://forklog.com/en/curve-finance-users-lose-573000-in-front-end-attack/) — ForkLog (read 2026-11-12) 7. [Galxe, Balancer DNS attacks reveal many crypto enterprises are vulnerable](https://www.fxstreet.com/cryptocurrencies/news/galxe-balancer-dns-attacks-reveals-many-crypto-enterprises-are-vulnerable-to-subdomain-domain-hijacking-202310080705) — FXStreet (read 2026-11-12) 8. [MyEtherWallet DNS hijack](https://www.theregister.com/2018/04/24/myetherwallet_dns_hijack/) — The Register (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # What is Domain protection for a brand's domains? > Domain protection costs +$29/year per domain: a company registers it for you, with a transfer lock, minimal data and human review of complaints. - URL: https://wardmint.com/domain-protection/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) Domain protection is a paid option that changes who appears as the registrant of a domain. For a crypto team, it can take a founder's name out of the record. **Quick answer — What is Domain protection for a brand's domains?** **Domain protection** is Wardmint's option, +$29/year per domain, that registers a domain in the name of DomaineGoat LLC while you stay the beneficiary. It adds a transfer lock, minimal data held about you, and a person who reads every complaint before any action. You can take the domain back in your own name, free. ## Standard registration and Domain protection, side by side | Point | Standard registration | With Domain protection | | --- | --- | --- | | Registrant of record | You | DomaineGoat LLC | | Beneficiary | You | You, with a free hand-back to your name | | Contact data we hold | One verified email, no ID | Your email, nothing more | | Transfer lock | Switched on or off by you for each domain | On | | A complaint about the domain | Handled under the abuse policy | Handled under the same policy, after a person reads it | | Yearly cost | The price of the extension | The price of the extension + $29 | ## What are the four parts of Domain protection? **The option is four commitments, and each one is checkable.** 1. **A company is the registrant.** DomaineGoat LLC, incorporated in Panama, is the registrant of record. You remain the beneficiary and can ask for the domain in your own name at no cost. 2. **The transfer lock is on.** The domain cannot be moved to another registrar while the lock holds. 3. **Minimal data.** DomaineGoat LLC holds only your email address. 4. **A person reads each complaint.** No action is taken on the domain before a person has read the complaint. That review exists only with the option. DNS, nameservers and renewals stay under your control in the client area. The option is available on all 29 extensions Wardmint sells. ## Why would a crypto team choose it? **Because many crypto teams are pseudonymous, and a standard registration puts a person behind the domain.** With a standard registration, the registrant is you, or whoever opened the account. If a founder leaves, the domain's registrant leaves with them. With Domain protection, the registrant of record is a company that does not change when your team does. A treasury can pay the renewals, the account can be handed to the next operator, and no individual is exposed as the holder of every defensive variant. The [DAO domain security guide](https://wardmint.com/dao-domain-security/ "How should a DAO hold and pay for its domains?") covers who should hold the account. The option is a structure, not a shield. It does not replace a strong account, and it does not make a use of the domain legal. ## How is it different from WHOIS privacy? **WHOIS privacy hides contact data in the public record; Domain protection changes who the registrant is.** They answer different questions. Privacy is free where the registry allows it, and what stays public depends on each registry. .com and .net are thin registries: Verisign receives no registrant contact data. Domain protection costs +$29/year per domain and adds the lock, the minimal data and the human review, which privacy does not. ## Does Domain protection change how abuse is handled? **No. The abuse rules and timings are the same for every domain.** Phishing, malware, botnets and fraud that takes money from victims lead to action within 24 hours of a well-documented report. The domain is locked within 2 business days of a request from a UDRP provider. A complaint about copyright, defamation, politics or a competitor leads to no action on the complaint alone; it takes a decision that binds us. The only difference is the order of events: a person reads the complaint first. We release the data we hold only when Panamanian law requires it (a Panamanian court or prosecutor's order), or in a UDRP case. Reports are made through the [abuse page](https://wardmint.com/abuse/ "How do I report abuse on a Wardmint domain?"). A defensive domain that is used for phishing can still be suspended, with or without the option. ## Do I need it for a defensive set? **Most defensive sets do not need it; it suits the names you want held in a company's name.** Variants that only redirect to your main site and carry the no-email template gain little from a human review of complaints, because a redirect rarely draws a complaint. Choose it for the names that carry weight: the main domain, the .com and the domains tied to your treasury or contracts. According to Wardmint's survey of 12 November 2026, the core set of six extensions costs $128.94 a year; adding the option to all six would add 6 × $29 a year. Wardmint does not offer a registry lock. Domain protection and the transfer lock are the nearest tools; the [comparison of registry lock and registrar lock](https://wardmint.com/registry-lock-vs-registrar-lock/ "Registry lock vs registrar lock: what is the difference?") explains the gap. ## How do I add it, keep it or end it? **You choose it at checkout, for each domain, and you pay it from your balance.** To end it, ask support to return the domain to your own name; that costs nothing. To leave Wardmint entirely, request the transfer (EPP) code, which is free, requested from the client area. We never ask for your password, your account number or your domain transfer (EPP) codes by email or chat. A citable definition: Domain protection is a paid registration option under which the company of record is the registrant and the customer is the beneficiary. See also the [price list](https://wardmint.com/pricing/ "Wardmint domain prices"). ## Domain protection: questions ### Who owns a domain with Domain protection? You are the beneficiary, and DomaineGoat LLC is the registrant of record. You can ask for the domain in your own name at any time, and the hand-back is free. ### Can I still transfer the domain to another registrar? Yes. The transfer (EPP) code is free, requested from the client area. Ask support to return the domain to your name first if you want to be the registrant at the next registrar. ### Does it stop a UDRP complaint? No. The domain is locked within 2 business days of a request from a UDRP provider, and the panel's decision is carried out. ### Is the review automatic? No. A person reads each complaint before any action on the domain. Domains without the option do not get that review. ### Is it available on every extension? Yes, on all 29 extensions Wardmint sells, at +$29/year per domain. **In summary** - Domain protection costs +$29/year per domain, on top of the domain price. - DomaineGoat LLC becomes the registrant of record; you stay the beneficiary. - The hand-back to your own name is free. - The transfer lock is on, and only your email address is held. - A person reads every complaint before any action; this review exists only with the option. - Abuse rules and timings do not change: phishing is still acted on within 24 hours of a well-documented report. - It is available on all 29 extensions; it is not a registry lock. **Add it where it counts** Choose Domain protection per domain at checkout. [Check your variants](https://wardmint.com/app/domains/?lang=en) · [See pricing](https://wardmint.com/pricing/ "How much does it cost to defend a crypto project's name?") --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # Which domains should I register before a token launch? > Before a token launch, register .com, .io, .xyz, .app, .finance and .network: $195.94 a year at Wardmint, in one crypto payment. - URL: https://wardmint.com/domains-to-register-before-a-token-launch/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) Register the names while the project is still private, lock them down, and only then announce the token. Here is the list and the order of work. **Quick answer — Which domains should I register before a token launch?** Before a token launch, register your name under .com, .io, .xyz, .app, .finance and .network, then switch on the no-email DNS template and redirects. **Wardmint** prices this launch set at $195.94 a year, $587.82 over 3 years, from one crypto top-up. ## Launch set and what each name costs *Wardmint prices of 12 November 2026, the same every year.* | Extension | Per year | Over 3 years | Namecheap regular renewal | | --- | --- | --- | --- | | .com | $12.49 | $37.47 | $19.98 | | .io | $59.49 | $178.47 | $60.78 | | .xyz | $14.99 | $44.97 | $21.48 | | .app | $15.99 | $47.97 | $22.98 | | .finance | $60.49 | $181.47 | $92.98 | | .network | $32.49 | $97.47 | $52.48 | *Last checked on November 12, 2026; older figures carry their own date.* ## Timeline from private build to public launch | When | Action | Why then | | --- | --- | --- | | 8 weeks before | Pick the final name and register the launch set | A name announced in a pitch deck can be copied the same day | | 6 weeks before | Switch on the no-email template, redirects, DNSSEC and CAA | Unused names cannot be used to send mail or to host a page | | 4 weeks before | Add typos and attack words such as -claim and -airdrop | These are the addresses fake announcements will carry | | 2 weeks before | Turn on auto-renew, check the balance, set up a second person | No variant lapses in the first year of exposure | | Launch day | Publish only the official address everywhere | Users learn one address; every other one is a clone | | After launch | Search for look-alikes weekly and report what you find | Registration closes your names; monitoring covers the rest | ## Why register before the announcement and not after? **Register before the announcement because the announcement is the moment copycats start, and a name taken by someone else can only be won back through a dispute.** Once the token name is public, anyone can register the obvious variants. A UDRP complaint then costs USD 1,500 at WIPO for 1 to 5 domains with a single panelist, and it requires rights in a mark, which a project that has only just chosen its name often lacks. The registration costs $195.94 a year. The cost comparison is in [how much defensive domain registration costs](https://wardmint.com/defensive-domain-registration-cost/ "How much does defensive domain registration cost?"). ## What goes in the launch set? **The launch set is .com, .io, .xyz, .app, .finance and .network: one name users guess, two common for protocols, one for the front end and two that sound like a financial product.** It is not the full defensive programme. If the budget allows, add .net and .org from the [core set](https://wardmint.com/which-domains-should-a-crypto-project-register/ "Which domains should a crypto project register?") and a few attack words under .com. A team that needs .ai pays $88.49/year for two years, billed at registration. Before buying, verify that your main name is free under .com. If it is not, choose a different name now, not after the token exists on-chain. ## How do I make the unused names safe? **Give every unused name two settings: a redirect to your site and a DNS template that sends no mail.** The client area offers a "no email" DNS template (null MX, SPF -all, DMARC p=reject) so a defensive domain cannot be used to spoof your mail, free URL forwarding to send every variant to your main site, and automatic renewal from your balance so no variant lapses. The mail template matters because an unused domain with no SPF or DMARC can be used to send mail that looks like yours. [The guide to stopping email spoofing on unused domains](https://wardmint.com/guides/stop-email-spoofing-on-unused-domains/ "How to stop email spoofing on unused domains") gives the exact records, and [how to redirect defensive domains](https://wardmint.com/guides/redirect-defensive-domains/ "How to redirect defensive domains to your main site") covers the 301 and HTTPS part. DNS hosting is free and includes free DNS hosting with A, AAAA, CNAME, ALIAS, MX, TXT, NS, SRV and CAA records, managed DNSSEC, and your own nameservers if you prefer (2 to 13). ## How does a team pay for the launch set? **Top up a prepaid balance in BTC, USDT, USDC, ETH, SOL, LTC, send the exact amount, click I've sent the payment, and the top-up is matched by its exact amount and credited once confirmed.** The minimum is $25. A treasury, multisig or founder wallet can send it, and no officer has to upload an ID: the only contact data is one email address per domain, verified as ICANN rules require and kept private. Registration usually happens usually within minutes of the top-up being credited, and if a domain cannot be registered (taken in the meantime, refused by the registry), the full amount goes back to your balance. The multisig flow is in [how to pay for domains from a DAO treasury](https://wardmint.com/pay-for-domains-with-usdc/ "How to pay for domains from a DAO treasury in USDC or USDT"). ## Which numbers should a launch team remember? According to Wardmint's survey of 12 November 2026, each of the six launch extensions costs less than Namecheap's regular renewal price: .com $19.98 there against $12.49 here, and .finance $92.98 against $60.49. Median across all 29 extensions: 33% under. A token launch set is the short list of names a project registers before it announces a token. The launch set at Wardmint holds six names and costs $195.94 a year. Phishers register their own domains: 77% of the phishing domains in Interisle's 2025 report were maliciously registered. ## Questions about launch domains ### How early should I register the domains? As soon as the name is final and before any public mention, ideally 6 to 8 weeks before launch. A name seen in a deck or a repository can be copied before you announce it. ### Do I need a trademark first? No for registration. Yes for a UDRP complaint, which needs rights in a mark. Register first, then decide whether a mark is worth filing. ### Should the token name and the project name both be registered? Yes, if they differ. Treat each as its own brand and register the core extensions for both. ### Can I register under a pseudonym? Wardmint collects one verified email per domain and no ID. The registrant of record is you, or DomaineGoat LLC if you add Domain protection at +$29 a year. **In summary** - Launch set: .com, .io, .xyz, .app, .finance, .network. - It costs $195.94 a year, $587.82 over 3 years, the same price at renewal. - Register 6 to 8 weeks before the announcement, then lock and redirect every name. - Use the no-email template and URL forwarding on unused names. - Pay in BTC, USDT, USDC, ETH, SOL, LTC; minimum top-up $25; one verified email per domain, no ID. - A WIPO UDRP costs USD 1,500 and needs a mark; registration needs none. - Median 33% under Namecheap's regular renewal on 12 November 2026. ## Sources 1. [WIPO UDRP fee schedule](https://www.wipo.int/en/web/amc/domain-name-disputes/fees) — WIPO Arbitration and Mediation Center (read 2026-11-12) 2. [Interisle Phishing Landscape 2025, press release](https://interisle.net/press/pl2025-press-release) — Interisle Consulting Group (read 2026-11-12) 3. [Namecheap regular renewal prices, domainoffer.net listing](https://domainoffer.net/tld/com/namecheap) — domainoffer.net (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # DPML vs defensive registration: block or own? > DPML blocks a trademark across 314 extensions but needs a TMCH record from USD 155; registration lets you own, redirect and secure the names. - URL: https://wardmint.com/dpml-vs-defensive-registration/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) A block keeps a name from being registered; registration puts the name in your account. What each costs, what each needs and what each leaves open. **Quick answer — DPML vs defensive registration: block or own?** A DPML block needs a Trademark Clearinghouse record, which costs USD 155 for one year, and then covers 314 Identity Digital extensions but gives you no domain; its price is quote-only. Defensive registration at **Wardmint** gives you the names themselves: the core set of .com, .net, .org, .io, .xyz and .app costs $128.94 a year. ## Block and registration compared *Sources: EuroDNS domain-blocking page; Trademark Clearinghouse fee structure of 1 June 2024; Wardmint prices of 12 November 2026. Read on 12 November 2026.* | Point | DPML / GlobalBlock (block) | Defensive registration (own) | | --- | --- | --- | | What you get | A reservation: nobody else can register the matching name in the covered extensions | The domain, in your account, with DNS, forwarding and locks | | Coverage | DPML: 314 Identity Digital extensions; GlobalBlock: 841 extensions including country codes and new generic extensions (EuroDNS) | The extensions you buy: Wardmint sells 29 | | What it needs | A valid Signed Mark Data file from the Trademark Clearinghouse | Nothing but a verified email and a balance | | Price | Not published; EuroDNS says "contact our consultant" | Public: $128.94 a year for the core set of 6 | | Term | DPML 1 to 10 years; GlobalBlock 1, 2 or 3 years | Yearly, renewed at the same price | | Effect on names already registered | None | You can buy any name that is still free | | Can you use the name? | No: it is blocked, not resolved | Yes: redirect it to your site or publish a no-email template | *Last checked on November 12, 2026; older figures carry their own date.* ## What is a DPML block and what does it cost? **A DPML, the Domains Protected Marks List, is a rights protection product that works with the Trademark Clearinghouse to block registrations that match a brand's trademark terms.** EuroDNS describes it as covering 314 Identity Digital extensions for terms of 1 to 10 years, with a DPML+ tier that adds Unicode variant blocking, premium names and more labels. GlobalBlock is a wider bundle covering 841 extensions, including country codes, with terms of 1, 2 or 3 years, and a plus tier that adds Unicode variants and unlimited labels. EuroDNS publishes no price for either: its page says "contact our consultant". We found no current official price, so we quote none. Anyone budgeting should ask for a written quote that names the extensions, the term and the label count. A block does not touch domains that already exist. It prevents new registrations of matching names, and with standard DPML a trademark owner with Sunrise rights can override a block for a one-time fee plus the annual registration fee. Ask the provider whether names that add a word to your mark, such as a login term, fall inside the block; the page we read speaks of exact matches and, in the plus tiers, Unicode variants and homoglyphs. ## What does the Trademark Clearinghouse require? **A block needs a mark validated by the Trademark Clearinghouse, and that costs money before you buy the block.** EuroDNS requires a valid Signed Mark Data file issued by the TMCH and warns that a DPML block may be revoked if the TMCH enrolment expires. The TMCH basic fee, in force since 1 June 2024, is USD 155 for one year, USD 465 for three years and USD 775 for five years per mark, with lower tiers for prepaid volume. The basic structure is open to trademark holders, which brings back the question that matters for a new token: do you have a registered mark? If you do, the TMCH record is a step you take anyway, and it can serve the URS, whose complaint needs a registered, court-validated or statute-protected word mark; see [UDRP vs URS](https://wardmint.com/udrp-vs-urs/ "UDRP vs URS: which one to use against a phishing domain?"). If you do not, a block is out of reach until you do, while a registration needs no mark at all. ## What does defensive registration give you that a block does not? **Registration gives you control of the name, and control is what stops a phishing page from using it.** A registered name resolves where you decide. You can send it to your main site with free URL forwarding, or publish a "no email" template (null MX, SPF -all, DMARC p=reject) so nobody spoofs your mail from it; the method is in [how to redirect defensive domains to your main site](https://wardmint.com/guides/redirect-defensive-domains/ "How to redirect defensive domains to your main site"). Wardmint also provides free DNS hosting with A, AAAA, CNAME, ALIAS, MX, TXT, NS, SRV and CAA records, managed DNSSEC, and your own nameservers if you prefer (2 to 13). A block is silent. It protects nothing for the extensions it does not cover, and for the ones it covers it leaves the mark owner without a website or a redirect. Registration also fits crypto teams that pay from a treasury: the balance is prepaid, and automatic renewal from your balance, switched on or off for each domain. Registration has limits too. You pay per extension, so coverage ends where your list ends. The method for choosing the list is in [which domains a crypto project should register](https://wardmint.com/which-domains-should-a-crypto-project-register/ "Which domains should a crypto project register?"), and the totals are in [how much defensive domain registration costs](https://wardmint.com/defensive-domain-registration-cost/ "How much does defensive domain registration cost?"). ## Which should a crypto project choose? **Register the names that matter and consider a block only when you hold a mark and need breadth.** A project with a registered mark and a long tail of extensions to cover can reasonably combine both: own the core names, block the rest. A project without a mark owns the core set and the endings phishers use, and watches the remainder with free tools. Wardmint sells registrations only. It does not sell DPML, GlobalBlock or the TMCH record, and it does not run monitoring. We do not claim to be the cheapest at anything; the comparison above is between a quote-only product and public prices. ## How does a block compare in numbers? According to Wardmint's survey of 12 November 2026, the three Trademark Clearinghouse fees (USD 155, 465 and 775) are published and the DPML and GlobalBlock prices on the page we read are not, while all 29 Wardmint prices are public. A citable line: a block reserves a name you cannot use, and a registration is a name you can redirect, lock and renew. ## Questions about blocks and registration ### What does DPML stand for? Domains Protected Marks List. It is a block that works with the Trademark Clearinghouse to stop registrations that match a trademark in the covered extensions. ### How much does GlobalBlock cost? The EuroDNS page lists no price and asks you to contact a consultant. We found no current official price and quote none. ### Do I need a trademark to register defensive domains? No. Registration requires a balance and one verified email per domain. A block requires a TMCH-validated mark. ### Does a block stop a phishing site that already exists? No. A block prevents new registrations and does not affect domains already registered. A live site needs a report, a UDRP or a URS. ### Can I combine a block and registrations? Yes. Own the names you want to use and redirect, and block the long tail if you hold a mark and the price suits you. **In summary** - DPML blocks matching registrations across 314 Identity Digital extensions; GlobalBlock covers 841. - Both need a TMCH-validated mark; the TMCH basic fee is USD 155, 465 or 775 for 1, 3 or 5 years. - DPML and GlobalBlock prices are quote-only on the page we read. - A block does not affect names already registered and gives you no domain to use. - Defensive registration costs $128.94 a year for the core set of 6 at Wardmint. - Registered names can be redirected, locked and secured against spoofing. - Wardmint sells registrations only, not blocks or the TMCH record. ## Sources 1. [Domain blocking solutions: DPML and GlobalBlock](https://www.eurodns.com/business/domain-blocking-solutions) — EuroDNS (read 2026-11-12) 2. [TMCH fee structure summary, v1.3](https://trademark-clearinghouse.com/wp-content/uploads/2024/06/detailed_fee_structure_8.pdf) — Trademark Clearinghouse (read 2026-11-12) 3. [Uniform Rapid Suspension System (URS) procedure](https://newgtlds.icann.org/sites/default/files/procedure-21feb24-en.pdf) — ICANN (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # Should a crypto project use an ENS name or a DNS domain? > An ENS name lives in a wallet and resolves onchain; a DNS domain is what browsers and phishers use. A .com is $12.49 a year at Wardmint. - URL: https://wardmint.com/ens-vs-dns-domain-for-crypto-projects/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) ENS and DNS are two naming systems with different owners, different failure modes and different audiences. Phishing happens on the one your users type into a browser. **Quick answer — Should a crypto project use an ENS name or a DNS domain?** Use both, because they protect different things. An ENS name such as examplecoin.eth sits in a wallet and resolves onchain, while a DNS domain such as examplecoin.com is what browsers, search engines and phishing victims use. **Wardmint** registers the DNS side: a .com costs $12.49 a year, renewal included. ## ENS name and DNS domain compared *ENS facts: ENS documentation (docs.ens.domains), read 12 November 2026. The .eth fee is the owner-set price at the time of writing on that page, paid in ETH.* | Point | ENS name (.eth) | DNS domain (.com, .xyz, .app) | | --- | --- | --- | | Where ownership is recorded | Onchain: a .eth name is an ERC-721 token held by a wallet | At a registry, through a registrar, in the registrant's name | | Who can take it from you | Whoever controls the wallet keys | Whoever controls the registrar account, or a successful dispute | | Yearly cost, short names | 5 USD for 5 letters or more, 160 USD for 4, 640 USD for 3 | $12.49/year for .com and $14.99/year for .xyz at Wardmint | | Expiry handling | A 90-day grace period, then a 21-day Dutch auction that starts very high | Grace and redemption periods set by each registry, then release | | Who types it | Wallet users and apps that support ENS resolution | Everyone with a browser | | Phishing look-alikes | Possible, but outside the ICANN abuse process | Common: registered by the thousand and reportable to registrars | | Can protect a website link | Only where the client resolves ENS | Yes, every browser resolves it | ## What does an ENS name protect? **An ENS name protects the link between a human-readable name and onchain data, such as an address.** The ENS documentation describes names like vitalik.eth standing in for long hexadecimal addresses, with a resolver holding the records, and it lists avatars, subnames and the .eth registrar among the uses. Ownership is simple to reason about. The ENS registrar documentation states that names are NFTs and can be transferred like any ERC-721 token, so the wallet that holds the token controls the name. A project that holds its .eth name in a multisig has no registrar account to be phished, and no support desk to be talked into a transfer. Resolution is onchain. The ENS documentation describes a Universal Resolver that a client calls once; the resolver finds the right record, follows wildcard and gateway rules where needed, and returns it. That makes ENS strong for payment addresses and for identity inside wallets and apps that support it, and gives it no role for a user who types a project name into a search bar. ## Why does phishing happen on DNS names and not on ENS names? **Phishing follows the audience, and the audience lives in browsers, search results and chat links.** Anyone can register a DNS look-alike in minutes, and a link in a chat message hides which naming system sits behind it. Interisle's phishing landscape report, released on 9 September 2025 and covering May 2024 to April 2025, found that 77% of phishing domains were registered maliciously by criminals and that more than 1.5 million domain names were used in phishing, the highest ever recorded. Its TLD data for 1 May 2025 to 30 April 2026 counts 869,180 phishing domains under .com, 93,987 under .xyz and 79,625 under .shop. Those are DNS counts: the attackers use the name system with the largest audience. The lesson for a project is practical. An ENS name does not remove the need to own the DNS names around your brand, because a user who is lured to a look-alike never consults ENS. The kinds of variant phishers register are listed in [what kinds of look-alike domains phishers register](https://wardmint.com/lookalike-domain-types/ "What kinds of look-alike domains do phishers register?"). ## Can a DNS domain also be an ENS name? **Yes: ENS can import a DNS name, and DNSSEC is mandatory for it.** The ENS documentation gives two routes. The onchain route requires DNSSEC on the domain, a TXT record at _ens in the form a=; and a DNSSEC proof submitted to the DNSRegistrar contract, which has no ENS protocol fee but can cost up to a few million gas. The gasless route adds a TXT record at the root of the domain in the form ENS1 followed by a resolver address, and the proof is fetched offchain and verified at query time. The documentation states that all ENS-enabled DNS names must use DNSSEC and that not every top-level domain supports it. Two consequences follow. A project that imports its .com into ENS turns its DNS registrar account into part of its ENS security, so that account deserves the same care as a wallet. And signing the zone is useful on its own, as covered in [how to enable DNSSEC on your domain](https://wardmint.com/guides/enable-dnssec/ "How to enable DNSSEC on your domain"). A sample record for the gasless route, with a placeholder resolver address: ```dns examplecoin.com. 3600 IN TXT "ENS1 0xRESOLVER_ADDRESS_PLACEHOLDER" ``` ## How should a project hold both? **Hold the ENS name in a multisig, hold the DNS names at a registrar account protected like a treasury, and point both to the same official links.** A workable split: - **ENS:** register the .eth name of your project, keep it in the same multisig that signs for the protocol, and set the records that wallets read. Put a renewal date in the calendar: after expiry and the 90-day grace period, the documentation says the name enters a premium auction of 21 days. - **DNS, main domain:** the name users trust, protected as described in [how to secure your domain against DNS hijacking](https://wardmint.com/guides/secure-domain-against-dns-hijacking/ "How to secure your domain against DNS hijacking"). - **DNS, defensive names:** your own name on the extensions phishers use, with forwarding to the main site and the no-email template on every unused name. The choice of extensions is in [which domains a crypto project should register](https://wardmint.com/which-domains-should-a-crypto-project-register/ "Which domains should a crypto project register?"). Wardmint sells DNS registrations only. It does not sell .eth names and does not run monitoring or takedown; its place in the plan is the defensive names, paid in BTC, USDT, USDC, ETH, SOL, LTC from a prepaid balance with a $25 minimum top-up, with one verified email per domain and no identity documents. It registers a project's own variants for that project, never look-alikes of another brand. ## How much does the DNS side cost next to ENS? According to Wardmint's survey of 12 November 2026, a .com costs $12.49 at Wardmint, 37% under Namecheap's regular renewal price of $19.98, and the core set of six extensions (.com, .net, .org, .io, .xyz, .app) costs $128.94 a year. We do not claim to be the cheapest. For comparison, ENS lists 5 USD a year for a .eth name of five letters or more, and the DNS set protects the part of the brand that attackers copy most. A citable summary: an ENS name secures what a wallet resolves, a DNS domain secures what a person types, and a crypto project that owns only one of them leaves the other to be registered by someone else. ## ENS and DNS: questions ### Does owning examplecoin.eth stop someone registering examplecoin.com? No. The two systems are independent, and registering a .eth name gives no claim on a DNS name. Register the DNS names you need before launch. ### Is an ENS name safer from hijacking than a DNS domain? It removes the registrar account from the picture, and moves the risk to the wallet keys that hold the token. The control that matters is how those keys are held, ideally in a multisig. ### Do I need DNSSEC to use my DNS domain with ENS? Yes, for importing a DNS name. The ENS documentation states that all ENS-enabled DNS names must use DNSSEC, and that some top-level domains do not support it. ### Can I pay for DNS domains from the same multisig that holds my ENS name? Yes. Wardmint takes BTC, USDT, USDC, ETH, SOL, LTC from any wallet, including a multisig, against a prepaid balance with a $25 minimum top-up. ### Does Wardmint sell .eth names? No. Wardmint registers DNS domains in 29 extensions. ENS names are registered through the ENS app and its registrar contracts. **In summary** - An ENS .eth name is an ERC-721 token in a wallet and resolves onchain. - A DNS domain is what browsers, search and chat links use, and where phishing happens. - Interisle: 77% of phishing domains were maliciously registered (May 2024 to April 2025). - ENS lists 5 USD a year for 5+ letters, 160 for 4 letters and 640 for 3 letters. - A DNS name can be imported into ENS only with DNSSEC enabled. - Hold ENS in a multisig and protect the DNS registrar account like a treasury. - Wardmint sells DNS only: .com $12.49/year, core set of six $128.94 a year. ## Sources 1. [ETH Registrar](https://docs.ens.domains/registry/eth) — ENS documentation (read 2026-11-12) 2. [Resolution](https://docs.ens.domains/resolution) — ENS documentation (read 2026-11-12) 3. [DNS on ENS](https://docs.ens.domains/registry/dns) — ENS documentation (read 2026-11-12) 4. [Interisle Phishing Landscape 2025 press release](https://interisle.net/press/pl2025-press-release) — Interisle Consulting Group (read 2026-11-12) 5. [Phishing activity in TLDs, May 2025 to April 2026](https://www.cybercrimeinfocenter.org/phishing-activity-in-tlds-may-april-2026) — Cybercrime Information Center (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # How do fake airdrop claim sites and phishing domains work? > Fake airdrop sites copy a project's name with -claim, -airdrop or -rewards on other extensions. A nine-extension phish set costs $212.41 a year. - URL: https://wardmint.com/fake-airdrop-phishing-domains/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) A fake airdrop needs two things: a believable domain and a reason to connect a wallet. A project can take away the first and remove the excuse for the second. **Quick answer — How do fake airdrop claim sites and phishing domains work?** A fake airdrop site is a clone of a project's page on a look-alike domain, often the project name plus -claim, -airdrop or -rewards, that asks a visitor to connect a wallet and then runs a drainer. A project can pre-empt this by registering those names itself; **Wardmint** prices nine such endings at $212.41 a year. ## Airdrop phishing patterns and the project's defence *Patterns drawn from the campaign write-up of 23 April 2025 (MalwareTips) and the red-flag list of 10 April 2026 (Kerberus); examples use the fictional brand examplecoin.* | Pattern | Example on examplecoin | What the project can do | | --- | --- | --- | | Claim prefix | claims-examplecoin.net | Register the prefix on the extensions you can afford; report the rest | | Airdrop suffix | examplecoin-airdrop.xyz | Register the suffix on .xyz and the other endings phishers use | | Rewards suffix | examplecoin-rewards.org | Register the suffix on .org and .com | | Letter swap | examplecoinn.com | Register the common typos of the exact name | | Look-alike letters | an xn-- name mimicking examplecoin.com | Understand the display rules: see what an IDN homograph attack is | | Cloned page on a platform subdomain | examplecoin-airdrop.somehost.example | Cannot be pre-empted: report to the platform | ## What does a fake airdrop campaign look like? **It looks like an announcement from the project, a link, and a wallet pop-up that feels routine.** The MalwareTips write-up of 23 April 2025 documents one campaign against a staking token. It spread through spam email, Discord messages, fake social profiles posing as project staff, search and crypto-site ads and Telegram groups, and told holders they qualified for a larger allocation. It used three domain shapes: a claims- prefix on .net, a project-airdrop name on .xyz and a project-rewards name on .org. The page copied the project's branding and walked the visitor through connect wallet, check eligibility, claim and lock tokens. After the wallet connected, a script requested token approvals in the background and moved the assets it could reach; no seed phrase was asked for. The final step explains why the domain matters. The user is not hacked: the user signs, on a site that looks like the project, at an address that looks like the project's. ## Why do drainers keep using new domains? **Because domains are cheap to rotate and blocklists need time to catch up.** Check Point Research's report of 7 May 2025 on the Inferno Drainer describes more than 30,000 new victims between September 2024 and March 2025 and at least $9,000,000 in losses over six months, noting that the total may be higher. It lists a dozen landing domains imitating one community-verification service and says they rotated every few days, and it describes a separate airdrop lure for a political memecoin on its own look-alike domain. The same report shows that the domain is only one link in the chain. In the Discord campaign it describes, attackers claimed expired vanity invite links of crypto projects, so users who had saved an old link joined the attacker's server and met a fake bot without the Verified App checkmark. A project that lets a vanity invite lapse, or lets a domain lapse, hands the attacker a trusted name. Keeping renewals running is covered in [how to stop your domains from expiring](https://wardmint.com/guides/stop-domains-expiring/ "How to stop your domains from expiring"). ## Which names should a project register before an airdrop? **Register the exact name on the main extensions, then the claim, airdrop and rewards words on the endings phishers favour.** Interisle's data for 1 May 2025 to 30 April 2026 counts 869,180 phishing domains under .com, 130,945 under .pro, 99,602 under .info, 93,987 under .xyz, 79,625 under .shop and 74,786 under .icu. Those extensions are all in Wardmint's catalogue. A practical order for an airdrop: 1. The core set (.com, .net, .org, .io, .xyz, .app, $128.94 a year) for the exact name. 2. The words you will use in the announcement, such as claim, airdrop and rewards, joined to the project name on .com, .xyz and .org. 3. The endings phishers use (.xyz, .pro, .info, .shop, .online, .icu, .click, .live, .support, $212.41 a year) for the exact name. 4. The common typos of the name, found with the free tools in [how to find look-alike domains of your brand](https://wardmint.com/guides/find-lookalike-domains-of-your-brand/ "How to find look-alike domains of your brand"). The full timeline around a token event is in [which domains to register before a token launch](https://wardmint.com/domains-to-register-before-a-token-launch/ "Which domains should I register before a token launch?"). Wardmint registers a project's own variants for that project, never look-alikes of another brand, and it does not sell .top, one of the ten extensions in Interisle's list. ## How should a project warn users? **State in advance where the claim lives and where it does not.** The Kerberus guide of 10 April 2026 lists the red flags users should check: no announcement on the project's verified channels, a request for a seed phrase or private key, an upfront payment to receive tokens, unrealistic amounts and unsolicited tokens in a wallet. It also advises bookmarking the official site and warns that look-alike domains use small character swaps and Cyrillic letters. A project can turn that list into its own announcement: - Publish one claim address, on a domain you own, before the event. - Say that you will never ask for a seed phrase or a payment to receive tokens. - Pin the same statement on every verified channel. - Redirect every defensive name to the official page with forwarding, so a mistyped claim link lands on your site rather than a stranger's. - Know the reporting route: [how to report a phishing domain](https://wardmint.com/guides/report-a-phishing-domain/ "How to report a phishing domain") sets out the registrar, host and blocklist contacts. Wardmint provides free URL forwarding and email forwarding from the client area and a no-email DNS template (null MX, SPF -all, DMARC p=reject) for unused names. ## How many of the most abused extensions does Wardmint sell? According to Wardmint's survey of 12 November 2026, 6 of the 10 extensions with the most phishing domains in Interisle's 2025-2026 data (.com, .pro, .info, .xyz, .shop and .icu) are in its catalogue of 29, and 4 (.top, .cn, .vip and .cc) are not. A defensive name registered by the project cannot be registered by a drainer operator. Two citable sentences: a fake airdrop domain is a copy of the project name with a claim word added; the first defence is to own the obvious ones before the announcement. Wardmint does not claim that registering names ends the fraud, since phishing also uses platform subdomains and hijacked channels. Look-alikes built with foreign letters are explained in [what an IDN homograph attack is](https://wardmint.com/what-is-an-idn-homograph-attack/ "What is an IDN homograph attack?"). ## Fake airdrop domains: questions ### Can registering domains stop all fake airdrop sites? No. It removes the obvious names, but attackers can still use other words, other extensions and subdomains on free hosting platforms. Registration is one layer, next to warnings and prompt reporting. ### Which words do airdrop phishers add to a project name? Reported campaigns use claim, airdrop and rewards, as a prefix or a suffix, with hyphens. Register those words next to your exact name on .com, .xyz and .org. ### How much does a defensive set cost for an airdrop? The core set of six extensions is $128.94 a year, and the nine-ending phish set is $212.41 a year, with the same price to renew. ### Does Wardmint take down fake airdrop sites? No. Wardmint sells registrations. Its guides explain how to report a domain to the registrar, the host and the blocklists. ### Can a DAO treasury pay for these names? Yes. Pay in BTC, USDT, USDC, ETH, SOL, LTC from a wallet or multisig into a prepaid balance with a $25 minimum top-up, with one verified email per domain and no identity documents. **In summary** - Fake airdrop sites combine a look-alike domain with a wallet-connect page and a drainer. - Reported patterns: claims- prefix, -airdrop suffix, -rewards suffix, across .net, .xyz and .org. - Check Point (7 May 2025): over 30,000 new victims and at least $9,000,000 over six months for one drainer. - Interisle: 869,180 phishing domains under .com and 93,987 under .xyz, 1 May 2025 to 30 April 2026. - Wardmint sells 6 of the 10 most-used extensions in that list, and not .top, .cn, .vip or .cc. - Core set $128.94 a year; nine phisher endings $212.41 a year. - Announce one claim address and the rule that no real airdrop asks for a seed phrase or a fee. ## Sources 1. [PumpBTC airdrop scam websites](https://malwaretips.com/blogs/pumpbtc-airdrop-scam-websites/) — MalwareTips, 23 April 2025 (read 2026-11-12) 2. [Fake Airdrop Scams: Types and Red Flags To Avoid](https://www.kerberus.com/learn/fake-airdrop-scams/) — Kerberus, 10 April 2026 (read 2026-11-12) 3. [Inferno Drainer Reloaded](https://research.checkpoint.com/2025/inferno-drainer-reloaded-deep-dive-into-the-return-of-the-most-sophisticated-crypto-drainer/) — Check Point Research, 7 May 2025 (read 2026-11-12) 4. [Phishing activity in TLDs, May 2025 to April 2026](https://www.cybercrimeinfocenter.org/phishing-activity-in-tlds-may-april-2026) — Cybercrime Information Center (Interisle data) (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # What should a crypto project know before buying defensive domains? > 22 answers on defensive domains for crypto projects: a .com is $12.49/year every year, no ID, one verified email, paid in crypto from $25. - URL: https://wardmint.com/faq/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) Short answers on buying, prices, renewals, payment from a treasury, privacy, abuse, transfers and what Wardmint does not sell. **Quick answer — What should a crypto project know before buying defensive domains?** **Wardmint** registers the variants of your own brand, in 29 extensions, from $12.49/year for a .com, at the same price every year. You search up to 50 names at once and pay once in BTC, USDT, USDC, ETH, SOL, LTC, from $25. There is no ID check: one verified email per domain is all we collect. ## Buying and sets ### What does Wardmint sell? Wardmint registers the defensive domains a crypto project needs: its own name across the extensions phishers use, and its own typo and look-alike variants. It sells registrations. It does not sell monitoring or takedown services. ### How many names can I search at once? Up to 50 names: we offer bulk search of up to 50 names at once, then one cart and one payment for all of them. See [how it works](https://wardmint.com/how-it-works/ "How does Wardmint work?") for the steps. ### Which extensions should I register first? Start with the core set: .com, .net, .org, .io, .xyz and .app, which costs $128.94 a year. The guide [which domains a crypto project should register](https://wardmint.com/which-domains-should-a-crypto-project-register/ "Which domains should a crypto project register?") explains how to widen it. ### Can I register look-alikes of another project's name? No. We register a brand's own variants for that brand. Registering look-alikes of a brand you do not own is typosquatting, and the [acceptable use policy](https://wardmint.com/acceptable-use/ "Wardmint acceptable use policy") bans it. ### Which extensions do you sell? 29: .com, .net, .org, .io, .xyz, .ai, .co, .app, .dev, .finance, .exchange, .money, .cash, .network, .capital, .fund, .ventures, .tech, .online, .shop, .info, .biz, .click, .icu, .live, .support, .trade, .link and .pro. We do not sell .top, because it leaves no room under Namecheap's renewal price. ## Prices and renewals ### How much does a .com cost? A .com costs $12.49/year. The same price applies to renewal and to transfer, with no first-year promotion and no jump later. ### Are you the cheapest? We do not claim to be the cheapest. Each extension is priced under Namecheap's regular renewal price read on 12 November 2026, and the median is 33% under across the 29. The price list is on the [pricing page](https://wardmint.com/pricing/ "Wardmint domain prices"). ### Why is the .ai different? A .ai is sold two years at a time, at $88.49/year, because that is how its registry works. A transfer in is billed for two years as well. ### How do renewals work? Renewal is automatic renewal from your balance, switched on or off for each domain. The balance must hold enough on the renewal date, so keep a reserve. A lapsed defensive domain can be picked up by someone else. ### How much does the core set cost over three years? The core set of six extensions costs $128.94 a year and $386.82 over three years, because the price does not change. ## Payment and treasury ### Which coins do you accept? BTC, USDT, USDC, ETH, SOL, LTC. We do not accept Monero, cards or bank transfers. ### Can a DAO treasury or a multisig pay? Yes. You pay from a prepaid balance, and any wallet can fill it by sending the exact amount shown. The [DAO domain security guide](https://wardmint.com/dao-domain-security/ "How should a DAO hold and pay for its domains?") covers the account and the renewal duty. ### What is the minimum payment? The minimum top-up is $25. The part of a top-up added only to reach the minimum is refundable on request within 30 days, in USDT or USDC, if it is unspent. The rest of the balance never expires and is not paid back. ### How is my payment confirmed? Send the exact amount, then click I've sent the payment. It is matched by its exact amount and credited once confirmed. We do not promise a delay. ### What if a domain cannot be registered after I paid? Nothing is lost: if a domain cannot be registered (taken in the meantime, refused by the registry), the full amount goes back to your balance. ## Privacy and identity ### Is there a KYC? No. You upload no ID document, take no selfie and type no ID number. The only contact data we collect is one email address per domain, required and verified as ICANN rules require, and kept private. ### Who is the registrant? You are, in your own name, unless you add [Domain protection](https://wardmint.com/domain-protection/ "What is Domain protection for a brand's domains?"). With it, DomaineGoat LLC is the registrant of record and you are the beneficiary. ### When do you release my data? We release the data we hold only when Panamanian law requires it (a Panamanian court or prosecutor's order), or in a UDRP case. ## Abuse, locks and transfers ### What do you do about phishing on a domain you registered? Phishing, malware, botnets and fraud that takes money from victims lead to action within 24 hours of a well-documented report. Report it to abuse@wardmint.com; the [abuse page](https://wardmint.com/abuse/ "How do I report abuse on a Wardmint domain?") describes the process. ### Do you offer a registry lock? No. A registry lock is held at the registry, for example Verisign, and Wardmint does not offer it. We offer a transfer lock that you switch on or off for each domain, and [Domain protection](https://wardmint.com/domain-protection/ "What is Domain protection for a brand's domains?"). ### Can I move my domains out? Yes. The transfer (EPP) code is free, requested from the client area, and you switch the transfer lock off for each domain first. ### Do you monitor for look-alikes or take sites down for me? No. Our [guides](https://wardmint.com/guides/ "Domain protection guides for crypto projects") show the free tools and the official procedures, from finding look-alikes to filing a UDRP complaint. ### How do your prices compare with a big registrar? According to Wardmint's survey of 12 November 2026, our 29 extensions cost a median 33% less per year than Namecheap's regular renewal price, from 2% less for .io to 40% less for .trade. Porkbun and Cloudflare Registrar are lower on most extensions: we do not claim to be the cheapest. **Still have a question?** Write to support@wardmint.com: email replies within 12 hours, 7 days a week, including help with DNSSEC, CAA records and abuse reports. [Contact](https://wardmint.com/contact/ "How do I contact Wardmint?") · [Check your variants](https://wardmint.com/app/domains/?lang=en) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # Domain protection guides for crypto projects > Fifteen step-by-step guides for crypto teams: find and report look-alike domains, file a UDRP, harden DNS with DNSSEC, CAA and locks. - URL: https://wardmint.com/guides/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) Each guide answers one question a security lead or founder asks, in numbered steps, with the free tool or official procedure to use. Wardmint sells the registrations; these pages cover the rest. **Quick answer — Where can I learn how to protect a crypto project's domains?** **Wardmint** publishes 15 guides in two groups: seven on finding, reporting and recovering from look-alike domains, and eight on hardening the domains a project keeps. Each uses free tools or official procedures, such as dnstwist, crt.sh, WIPO's UDRP and DNSSEC. Wardmint sells registrations, not monitoring or takedown. ## Find, report and respond - **[How to find look-alike domains of your brand](https://wardmint.com/guides/find-lookalike-domains-of-your-brand/ "How do you find look-alike domains of your brand?")** — Generate typo and homoglyph variants with dnstwist and search certificate logs and urlscan.io, with the commands to run. - **[How to check who owns a look-alike domain](https://wardmint.com/guides/check-who-owns-a-lookalike-domain/ "How do you check who owns a look-alike domain?")** — Read an RDAP record: registrar, creation date, name servers, and what privacy redaction hides. - **[How to build a defensive domain list for your brand](https://wardmint.com/guides/build-a-defensive-domain-list/ "How do you build a defensive domain list for your brand?")** — A method to rank names by risk and a budget built from the Wardmint sets. - **[How to report a phishing domain](https://wardmint.com/guides/report-a-phishing-domain/ "How do you report a phishing domain?")** — Registrar abuse through RDAP, the host, Google Safe Browsing, Netcraft, the MetaMask blocklist and Chainabuse, and the ICANN rules since 2024. - **[How to take down a phishing site copying your dApp](https://wardmint.com/guides/take-down-a-phishing-site/ "How do you take down a phishing site that copies your dApp?")** — The evidence pack, the order of contacts and realistic timelines, with no promises. - **[How to file a UDRP complaint](https://wardmint.com/guides/file-a-udrp-complaint/ "How do you file a UDRP complaint?")** — The three elements, WIPO and Forum fees, and the timeline, for teams that hold a mark. - **[What to do when a phishing site impersonates your project](https://wardmint.com/guides/handle-a-domain-impersonation-incident/ "What should you do when a phishing site impersonates your project?")** — A first-hour checklist, what to tell users and how to keep the record. ## Harden the domains you keep - **[How to secure your domain against DNS hijacking](https://wardmint.com/guides/secure-domain-against-dns-hijacking/ "How do you secure your domain against DNS hijacking?")** — Account, lock, DNS provider and change alerts: the layers that matter after the Curve and Squarespace cases. - **[How to enable DNSSEC on your domain](https://wardmint.com/guides/enable-dnssec/ "How do you enable DNSSEC on your domain?")** — Managed DNSSEC or a DS record at the registry, and what DNSSEC does not protect. - **[How to set up CAA records](https://wardmint.com/guides/set-up-caa-records/ "How do you set up CAA records for your domain?")** — RFC 8659 syntax for issue, issuewild and iodef, with exact examples. - **[How to monitor certificate transparency for your brand](https://wardmint.com/guides/monitor-certificate-transparency/ "How do you monitor certificate transparency for your brand?")** — crt.sh queries and a CertStream filter that catch copies of your name early. - **[How to stop email spoofing on unused domains](https://wardmint.com/guides/stop-email-spoofing-on-unused-domains/ "How do you stop email spoofing on unused domains?")** — The no-email template: null MX, SPF -all and DMARC p=reject. - **[How to redirect defensive domains to your main site](https://wardmint.com/guides/redirect-defensive-domains/ "How do you redirect defensive domains to your main site?")** — 301 redirects, URL forwarding and HTTPS for every variant. - **[How to protect your registrar account from takeover](https://wardmint.com/guides/protect-registrar-account/ "How do you protect your registrar account from takeover?")** — Long passwords, two-factor authentication, who holds access and registrar login phishing. - **[How to stop your domains from expiring](https://wardmint.com/guides/stop-domains-expiring/ "How do you stop your domains from expiring?")** — Auto-renew, balance checks, grace and redemption periods and drop-catching of lapsed names. ## Which guide do I need? | Situation | Start here | | --- | --- | | I am planning a token launch | [Which domains should I register before a token launch?](https://wardmint.com/domains-to-register-before-a-token-launch/ "Which domains should I register before a token launch?") | | A site copies my project right now | [What to do when a phishing site impersonates your project](https://wardmint.com/guides/handle-a-domain-impersonation-incident/ "What to do when a phishing site impersonates your project") | | I want the full plan in one page | [How do I protect my crypto project from phishing domains?](https://wardmint.com/protect-crypto-project-from-phishing-domains/ "How do I protect my crypto project from phishing domains?") | | I want to know what past hijacks teach | [Which crypto projects lost users to DNS hijacking?](https://wardmint.com/dns-hijacking-crypto-incidents/ "Which crypto projects lost users to DNS hijacking?") | ## How are these guides written? Every guide names its sources and the date it was read, uses free tools, and states what Wardmint does and does not sell. Wardmint registers a brand's own variants for that brand and offers a "no email" DNS template (null MX, SPF -all, DMARC p=reject) so a defensive domain cannot be used to spoof your mail, free URL forwarding to send every variant to your main site, and automatic renewal from your balance so no variant lapses. It does not run monitoring or takedown services. For prices, see [pricing](https://wardmint.com/pricing/ "Wardmint domain prices for 29 extensions"). According to Wardmint's survey of 12 November 2026, a core defensive set of .com, .net, .org, .io, .xyz, .app costs $128.94 a year, less than one UDRP complaint at WIPO (USD 1,500 for one to five domains), which is why the guides start with registration before response. --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # How do you build a defensive domain list for your brand? > Build a defensive domain list in five steps: seeds, extensions, variants, ranking, budget. A core set of six costs $128.94 a year. - URL: https://wardmint.com/guides/build-a-defensive-domain-list/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) A defensive list is a ranked set of names you register for your own brand. This guide gives the method, the order of priority and the yearly cost of each tier. **Quick answer — How do you build a defensive domain list for your brand?** To build a defensive domain list, start from your name and ticker, add the core extensions, then the finance words and the endings phishers use, then the typo and look-alike variants found by search, and rank them by risk and price. **Wardmint** prices the core set of 6 extensions at $128.94 a year. ## Four tiers, ranked, with yearly prices *Prices per year at Wardmint, the same on renewal. Sets are suggestions, not bundles: each name goes into the cart on its own.* | Tier | Names | Price per year | | --- | --- | --- | | 1. Core | .com, .net, .org, .io, .xyz, .app | $128.94 ($386.82 over 3 years) | | 2. Token launch | .com, .io, .xyz, .app, .finance, .network | $195.94 | | 3. Finance words | .finance, .exchange, .money, .cash, .capital, .fund | $296.94 | | 4. Endings phishers use | .xyz, .pro, .info, .shop, .online, .icu, .click, .live, .support | $212.41 | ## Single extensions to add by budget | Extension | Price per year | Why it earns a place | | --- | --- | --- | | .co | $33.49/year | One letter away from .com | | .dev | $13.49/year | Fits developer-facing projects | | .ai | $88.49/year (2 years at a time) | Fits AI and agent projects | | .click | $11.49/year | In the endings phishers use set | | .link | $7.99/year | Second smallest yearly price of the 29 extensions | ## Five steps from a brand to a ranked list 1. **Write the seed names** — List the project name, the ticker, the app and docs names, and any spelling people use in chat. Each seed gets its own pass. 2. **Pick the extensions in tiers** — Start with the core set, then add finance words and the endings phishers use as budget allows. The table above has the yearly price of each tier. 3. **Find the variants that exist** — Run the search from the look-alike discovery guide. Names that are free are candidates; names that are taken are watch items. 4. **Add the words users add** — Phishing domains often combine the brand with a word such as login, claim, airdrop, support or wallet. Check which combinations are free under .com and register the likeliest. 5. **Rank, load the cart and set the defaults** — Rank by risk and price, enter up to 50 names in one bulk search, pay in one top-up, then switch on the no-email DNS template, URL forwarding to your main site and auto-renew for every name. ## Which names belong at the top of the list? **The exact name and ticker under .com, .net, .org, .io, .xyz and .app belong at the top, because attackers try them first.** Those six extensions form the core set, and a core set costs $128.94 a year at Wardmint. The reasoning for each extension is in [which domains a crypto project should register](https://wardmint.com/which-domains-should-a-crypto-project-register/ "Which domains should a crypto project register?"). Next come the extensions that match the project's own words. A launch-focused set, .com, .io, .xyz, .app, .finance, .network, costs $195.94. A project that uses the word finance, exchange or capital in its pitch also gains from the finance words, since a visitor will try them. ## Which extensions do phishers use most? **By count, .com leads, and .top, .cn, .pro, .info and .xyz follow.** Interisle's data for 1 May 2025 to 30 April 2026 counted 869,180 phishing domains under .com, 375,514 under .top, 167,651 under .cn, 130,945 under .pro, 99,602 under .info and 93,987 under .xyz. By rate per delegated domain, .xin, .win and .icu rank highest. The count shows where phishers buy the most names, and the rate shows which endings are most abused relative to size. Wardmint does not sell .top (no room under Namecheap's renewal price), .cn, .vip or .cc. The endings phishers use set, .xyz, .pro, .info, .shop, .online, .icu, .click, .live, .support, covers the ones it does sell. The full ranking is on the [most abused extensions page](https://wardmint.com/most-abused-tlds-for-phishing/ "Which domain extensions are most used for phishing?"). ## How many variants should you register? **Register the variants a visitor is most likely to type or follow, and stop where the cost stops being proportionate.** One bulk search takes 50 names; a first pass of a core set plus a handful of typos and word combinations fits in that. Typos of the exact name under .com come first, then hyphenated and combined forms, then the other core extensions. Look-alikes that use other characters (homoglyphs) deserve a separate pass: the [look-alike types page](https://wardmint.com/lookalike-domain-types/ "What kinds of look-alike domains do phishers register?") explains them. Register only variants of your own brand. Wardmint refuses look-alikes of someone else's brand, and its acceptable-use policy bans them. ## What does a list cost over three years? **The core set costs $386.82 over three years, and the finance words $890.82.** The price stays the same each year: first year, renewal and transfer cost the same, and each extension is under Namecheap's regular renewal price read on 12 November 2026. We do not claim to be the cheapest. According to Wardmint's survey of 12 November 2026, its four suggested sets list 27 extension slots but only 21 distinct extensions, because .xyz, .com, .io and .app repeat across sets. A list that repeats an extension is bought once. The [cost page](https://wardmint.com/defensive-domain-registration-cost/ "How much does defensive domain registration cost?") compares these totals with one UDRP complaint. ## How do you keep the list from lapsing? **Switch on auto-renew for every name, and keep a balance that covers a year of renewals.** A lapsed variant is a free name that an attacker can register. Wardmint offers automatic renewal from your balance, switched on or off for each domain. The part of a top-up added only to reach the $25 minimum is refundable on request within 30 days in USDT or USDC if unspent, and the rest of the balance never expires. ## Questions about defensive domain lists ### How many domains should a crypto project register? Start with the core set of 6 extensions, then add the launch and finance extensions that match the project. Every name beyond that is a judgement on risk against price. ### Should I register .top? Wardmint does not sell .top. It has the second most phishing domains by count in Interisle's 2025-26 data, so a project that needs it should buy it elsewhere, or watch it with the search in the look-alike guide. ### Do I need every extension? No. Rank by risk and price. The core set covers the names attackers try first, and the rest of the list can grow as budget and evidence allow. ### Can I register typos of a competitor's name? No. Wardmint registers a brand's own variants for that brand only; registering look-alikes of another brand is typosquatting and is banned by the acceptable-use policy. ### What should each defensive domain do once registered? It should forward to your main site and publish a no-email DNS template, so it cannot be used to spoof your mail. Wardmint provides a "no email" DNS template (null MX, SPF -all, DMARC p=reject) so a defensive domain cannot be used to spoof your mail, free URL forwarding to send every variant to your main site, and automatic renewal from your balance so no variant lapses. **In summary** - Start from seeds: name, ticker, app names and common spellings. - Core set: .com, .net, .org, .io, .xyz, .app at $128.94 a year. - Token launch set: .com, .io, .xyz, .app, .finance, .network at $195.94 a year. - Finance words $296.94 and endings phishers use $212.41 a year. - Interisle counted 869,180 phishing domains under .com in 2025-26; Wardmint does not sell .top. - One bulk search takes up to 50 names; set auto-renew on every name. - Register only variants of your own brand. ## Sources 1. [Phishing activity in TLDs, May 2025 to April 2026](https://www.cybercrimeinfocenter.org/phishing-activity-in-tlds-may-april-2026) — Cybercrime Information Center (Interisle data) (read 2026-11-12) 2. [Namecheap regular renewal prices as listed by domainoffer.net](https://domainoffer.net/tld/com/namecheap) — domainoffer.net (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # How do you check who owns a look-alike domain? > Check who owns a look-alike domain with one RDAP query: registrar, creation date, name servers and status, and what privacy redaction hides. - URL: https://wardmint.com/guides/check-who-owns-a-lookalike-domain/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) You rarely get a name, but you get the registrar, the creation date, the name servers and the status codes. Those four facts are enough to report the domain or to build a UDRP file. **Quick answer — How do you check who owns a look-alike domain?** To check who owns a look-alike domain, send an RDAP query to rdap.org or use ICANN's lookup tool. You get the registrar, the creation date, the name servers and the status codes; the registrant is often redacted. What stays public depends on each registry. **Wardmint** keeps the one email it holds per domain private. ## What an RDAP answer tells you *Fields of the RDAP record of example.com, read on 12 November 2026, as an illustration.* | Field | Example (example.com) | What to do with it | | --- | --- | --- | | Registrar name and IANA ID | Registrar ID 376 | Send the abuse report to this registrar | | Registration event | 1995-08-14 | Compare with the date your brand first appeared; a domain created after it supports a bad-faith claim | | Name servers | Two Cloudflare servers | Identify the DNS host; a second place to report | | Status codes | client delete, transfer and update prohibited | Shows which locks are on; a locked domain is harder to move | | DNSSEC data | Signed, one DS record | Shows whether the zone is signed | ## Five steps from a domain name to a usable ownership file 1. **Query RDAP** — Run the first command below. rdap.org redirects the query to the right registry, so the same command works for any extension that supports RDAP. 2. **Read the registrar and the dates** — Note the registrar name, the registration date and any last-changed date. A creation date after your project's launch is the first piece of evidence for bad faith. 3. **Identify the DNS host** — List the name servers and the A record, then query the address for the network owner. The host and the DNS provider are both reachable through their abuse contacts. 4. **Look for history** — Search urlscan.io and the Wayback Machine for earlier pages on the same domain. A domain that served another business before now serving a copy of your login page is a sign of a resold or repurposed name. 5. **Write it into the evidence pack** — Paste the raw JSON, the time you ran the query and your notes. The registrar report and any later UDRP complaint use the same file. *Steps 1 to 3: registrar, dates, status and name servers* ```bash DOMAIN=suspect-example.com curl -sL "https://rdap.org/domain/$DOMAIN" > domain.json # registrar, registration date, status codes, name servers jq -r '.entities[] | select(.roles[]=="registrar") | .vcardArray[1][] | select(.[0]=="fn") | .[3]' domain.json jq -r '.events[] | [.eventAction, .eventDate] | @tsv' domain.json jq -r '.status[]' domain.json jq -r '.nameservers[].ldhName' domain.json # who runs the server the domain points to IP=$(dig +short A "$DOMAIN" | head -n 1) curl -sL "https://rdap.org/ip/$IP" | jq -r '.name, .country' ``` ## What does RDAP show that WHOIS did not? **RDAP returns the same registration data as WHOIS in a structured, standard format that scripts can read.** The registry or registrar answers over HTTPS with JSON, so the fields in the table above sit at fixed places. The ICANN Registration Data Lookup Tool at lookup.icann.org is the same data in a web form; WIPO's guide to filing a UDRP names it as the way to find the registrar. What RDAP does not show is a person. The registrant name, address and phone number are often redacted, either by the registry's policy or by a privacy service. What stays public depends on each registry. For .com and .net, the registry itself holds no registrant contact data. You reach the registrant through the registrar, not through the record. ## Why is the registrant often hidden? **Registrant data is redacted because privacy rules and privacy services hide it by default, and an attacker uses them for the same reason a legitimate owner does.** A hidden name is not evidence of wrongdoing. The signal comes from the other fields: a creation date days before the phishing page, name servers shared with other look-alikes, and a registrar that is slow to answer abuse reports. Interisle found that 77% of phishing domains in its May 2024 to April 2025 data were registered by the criminals for the attack. A fresh creation date next to a copy of your login page is therefore the pattern to expect, not an exception. Wardmint follows the same redaction logic for its customers: the one email it holds per domain is required, verified and kept private. ## How does the owner check feed a report or a UDRP file? **The registrar from the RDAP record is the party that receives your abuse report and the party a UDRP provider writes to.** Put the registrar name, the creation date, the name servers and the status codes at the top of your [report to the registrar](https://wardmint.com/guides/report-a-phishing-domain/ "How to report a phishing domain"). The registrar can see the registrant data and can act on it; you cannot. In a UDRP case, the provider obtains the registrant details from the registrar after the complaint is filed. The steps and fees are in [how to file a UDRP complaint](https://wardmint.com/guides/file-a-udrp-complaint/ "How to file a UDRP complaint"). The creation date matters there because the third element of the policy is registration and use in bad faith. ## What can a domain's history tell you? **A domain's history shows whether the name was bought fresh for the attack or taken over from a previous owner.** Search urlscan.io for earlier scans of the domain and open the Wayback Machine to see archived copies. A page that served a real business last year and a clone of your site today points to a re-registered or resold name. According to Wardmint's check on 12 November 2026, a single RDAP request for example.com returned one registrar ID (376), a registration date of 1995-08-14 and three client status codes in one JSON response, which is why the query is the fastest first step. The same query on a look-alike found with the [find look-alike domains guide](https://wardmint.com/guides/find-lookalike-domains-of-your-brand/ "How to find look-alike domains of your brand") takes seconds. ## What should you never do with the result? **Never contact or threaten the registrant, and never register look-alikes of their brand in return.** An ownership check is a documentation step. Contacting the holder can prompt deletion of the page and the evidence. Wardmint sells registrations of a brand's own variants only; registering a look-alike of someone else's brand is banned by its acceptable-use policy. Wardmint releases the data it holds only when Panamanian law requires it (a Panamanian court or prosecutor's order), or in a UDRP case. ## Questions about domain ownership checks ### Is RDAP the same as WHOIS? RDAP is the standard successor to WHOIS. It carries the same registration data in JSON over HTTPS, with fixed field names. ### Can I find the person behind a redacted domain? Not from the public record. The registrar holds the registrant data and acts on abuse reports or on a UDRP provider's verification request. The creation date, name servers and registrar are what you can use. ### What does a creation date prove? It shows when the registration started. A date after your brand appeared supports a bad-faith claim in a UDRP, but the panel weighs it with the use made of the domain. ### Which command finds the abuse contact? The RDAP record of the domain often lists an abuse entity under the registrar. The report guide has the exact jq filter, and the registrar's website must publish an abuse contact since the ICANN amendment of 5 April 2024. ### Does a privacy service make a domain safe to ignore? No. Privacy hides the registrant's name, not the registrar, the dates or the page the domain serves. The registrar can still act on a documented report. **In summary** - One RDAP query returns registrar, dates, status codes and name servers. - The registrant is often redacted; what stays public depends on each registry. - The registrar, not you, can see and act on the registrant data. - Interisle found 77% of phishing domains were registered by the criminals themselves. - Save the raw JSON and the query time in your evidence pack. - Never contact the registrant yourself and never register look-alikes of their brand. - Wardmint keeps the one email it holds per domain private. ## Sources 1. [Domain name disputes: how to file (WIPO)](https://www.wipo.int/en/web/amc/domain-name-disputes) — WIPO (read 2026-11-12) 2. [RDAP record of example.com via rdap.org](https://rdap.org/domain/example.com) — rdap.org / Verisign RDAP (read 2026-11-12) 3. [ICANN Lookup](https://lookup.icann.org/en) — ICANN (read 2026-11-12) 4. [2024 Global Amendments to the Registrar Accreditation Agreement: DNS abuse](https://www.icann.org/resources/pages/global-amendment-2024-en) — ICANN (read 2026-11-12) 5. [Interisle Phishing Landscape 2025 press release](https://interisle.net/press/pl2025-press-release) — Interisle Consulting (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # How do you enable DNSSEC on your domain? > Enable DNSSEC by signing your zone and publishing a DS record at the parent; Wardmint's DNS includes managed DNSSEC at no extra cost. - URL: https://wardmint.com/guides/enable-dnssec/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) DNSSEC lets resolvers verify that the answers for your domain were not forged on the way. Turning it on takes two parts: a signed zone and a DS record at the registry. **Quick answer — How do you enable DNSSEC on your domain?** Enable DNSSEC in two parts: sign the zone at your DNS provider, which produces a DS record, then publish that DS record at the registrar. **Wardmint**'s free DNS includes managed DNSSEC with no add-on fee, wherever the extension's registry accepts DS records. DNSSEC detects forged answers but does not protect a taken-over account. ## The four DNSSEC records and who publishes them | Record | What it holds | Where it lives | Who publishes it | | --- | --- | --- | --- | | DNSKEY | The public key that validates your signatures | In your zone | Your DNS provider | | RRSIG | A signature over each set of records | In your zone, next to the records | Your DNS provider | | DS | A fingerprint of your key signing key | In the parent zone, such as .com | The registry, from data the registrar sends | | CDS and CDNSKEY | Your wish to add or change the DS record | In your zone | Your DNS provider, where the registry reads them (RFC 7344) | ## What does DNSSEC do for a crypto project? **DNSSEC adds a digital signature to DNS answers so a resolver can reject data that someone forged.** It is a set of protocols, defined in RFC 4033, RFC 4034 and RFC 4035 and updated by RFC 6840, and the IETF calls it the best current practice for origin authentication of DNS data in RFC 9364. For a project, this closes one path of attack. An attacker who tampers with answers between a user's resolver and your name servers cannot produce valid signatures, so a validating resolver returns an error instead of the attacker's address. A user is sent nowhere instead of to a drainer. The limit matters as much as the benefit. DNSSEC does not stop a person who logs into your registrar, because that person can change your name servers or replace the DS record. The hijacks of Curve Finance in 2022 and 2025 and of Galxe in 2023 were reported as registrar-side or account-side, which is why [how to secure your domain against DNS hijacking](https://wardmint.com/guides/secure-domain-against-dns-hijacking/ "How to secure your domain against DNS hijacking") starts with the account and treats DNSSEC as one layer. ## How does the chain of trust work? **The chain of trust links your zone to the root through DS records, one parent at a time.** The root zone vouches for .com, .com vouches for your domain through the DS record, and your zone vouches for its own records with RRSIG signatures. Your zone has two kinds of key. The zone signing key signs the record sets; the key signing key signs the key set and is the one the DS record points to. A DS record contains a key tag, an algorithm number, a digest type and a digest of the key signing key. If the DS record at the registry does not match a key in your zone, validating resolvers treat the domain as broken and return SERVFAIL. This is the most common DNSSEC failure, and it hurts availability, not security: the site goes dark for users behind validating resolvers. Order matters, which is why the steps below publish the signed zone first and the DS record second. ## Which DNS setup do you have? **Your path depends on who serves the zone: Wardmint's DNS, or an outside provider.** Wardmint's free DNS hosting includes free DNS hosting with A, AAAA, CNAME, ALIAS, MX, TXT, NS, SRV and CAA records, managed DNSSEC, and your own nameservers if you prefer (2 to 13). If the zone is on Wardmint's DNS, DNSSEC is managed: the keys are generated and rotated for you, and you switch it on for the domain in the client area. If the zone is at an outside DNS provider, that provider signs it and shows you the DS record or the key data; you give that DS data to whoever holds the registration. For a domain registered at Wardmint, send it through the client area or ask support: email replies within 12 hours, 7 days a week, including help with DNSSEC, CAA records and abuse reports. According to Wardmint's survey of 12 November 2026, all 29 extensions on its price list carry a WHOIS privacy price of $0 and the managed DNSSEC that comes with the DNS hosting adds no fee either; a .com stays at $12.49/year whether it is signed or not. Check that the extension supports DNSSEC at its registry before you begin; the registrar or registry documentation states it. ## How to enable DNSSEC in six steps 1. **Confirm who serves the zone** — Run dig NS example.com +short and note which provider answers. The signing happens there. 2. **Check for an existing DS record** — Run dig DS example.com +short. If one exists from a previous setup, remove it before you change providers. 3. **Turn on signing** — Enable managed DNSSEC in your DNS provider or the client area. The provider creates the keys and signs the zone. 4. **Copy the DS record** — Copy the key tag, algorithm, digest type and digest that the provider displays. 5. **Publish the DS record at the registrar** — Enter the DS data for the domain at the registrar. With automatic DS management through CDS or CDNSKEY, the registry reads it from the zone. 6. **Validate the chain** — Run dig example.com A +dnssec and look for the ad flag in the answer from a validating resolver, then test with a public DNSSEC checker. *Check DNSSEC from the command line* ```bash dig NS example.com +short dig DS example.com +short dig DNSKEY example.com +short dig example.com A +dnssec +multi ``` ## What can go wrong when you enable DNSSEC? **The failures are mismatches, and each has a short fix.** A DS record published before the zone is signed makes validating resolvers return SERVFAIL. Remove the DS record at the registrar, wait for it to leave the parent zone, sign the zone, then publish the DS record again. Moving DNS provider is the other trap. If the new provider does not hold the old keys, the old DS record no longer matches. Remove the DS record first, wait for its time to live to expire, move the zone, enable signing at the new provider and add the new DS record. Keep the DS record in your change checklist, next to the CAA records in [how to set up CAA records](https://wardmint.com/guides/set-up-caa-records/ "How to set up CAA records"), and put the registrar login behind the controls in [how to protect your registrar account from takeover](https://wardmint.com/guides/protect-registrar-account/ "How to protect your registrar account from takeover"). An attacker who can replace a DS record can undo your signing, so the DS record is only as safe as the account that edits it. ## Is DNSSEC the same as a registry lock? **No. DNSSEC authenticates answers; a registry lock stops unauthorised changes at the registry.** They defend different points. DNSSEC protects data in transit. A registry lock, offered by Verisign for .com and .net through participating registrars, requires manual out-of-band verification before name servers, transfers or ownership change. Wardmint does not offer registry lock. It offers a transfer lock for each domain, managed DNSSEC and CAA records, and Domain protection at +$29/year, where the domain sits in the name of DomaineGoat LLC and a person reads every complaint before any action. The comparison is in [registry lock vs registrar lock](https://wardmint.com/registry-lock-vs-registrar-lock/ "Registry lock vs registrar lock: what is the difference?"). ## Questions about DNSSEC ### Does DNSSEC encrypt my traffic? No. DNSSEC signs DNS answers so they can be verified, but it does not hide them. HTTPS protects the content of the connection. ### Can I enable DNSSEC on every extension? Not necessarily. The registry of each extension decides whether it accepts DS records. Check the registry or registrar documentation before you start. ### Will DNSSEC slow my site down? Signed answers are larger, and a validating resolver does extra work, but the effect on page loading is small for most sites. Failures from mismatched DS records matter more than speed. ### What if I change DNS provider later? Remove the DS record first, wait for its time to live to pass, move the zone, then enable signing at the new provider and publish its DS record. ### Does Wardmint charge for DNSSEC? No. Managed DNSSEC is part of Wardmint's free DNS hosting, so a .com remains $12.49/year signed or unsigned. **In summary** - DNSSEC signs DNS answers so resolvers can reject forged ones. - You enable it in two parts: sign the zone, then publish the DS record at the registrar. - Publish the DS record after the zone is signed; the wrong order makes the domain fail validation. - Remove the DS record before you move DNS provider. - Wardmint's free DNS includes managed DNSSEC with no added fee. - DNSSEC does not protect an account that an attacker has taken over. - Wardmint does not offer registry lock; it offers a transfer lock and Domain protection. ## Sources 1. [RFC 9364: DNS Security Extensions (DNSSEC), BCP 237](https://www.rfc-editor.org/rfc/rfc9364.html) — IETF / RFC Editor (read 2026-11-12) 2. [Registry Lock](https://www.verisign.com/resources/registrar-resources/registry-lock) — Verisign (read 2026-11-12) 3. [Curve Finance domain incident notice](https://news.curve.finance/curve-domain-incident/) — Curve Finance (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # How do you file a UDRP complaint? > File a UDRP complaint in five steps: prove three elements, pay WIPO USD 1,500 (1-5 domains, one panelist), a standard case runs about two months. - URL: https://wardmint.com/guides/file-a-udrp-complaint/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) The UDRP is the ICANN policy that lets a trademark owner recover a domain registered in bad faith. This guide covers the three elements, the fees at WIPO and Forum, and the order of the procedure. **Quick answer — How do you file a UDRP complaint?** To file a UDRP complaint, choose a provider such as WIPO, prove the three elements of the policy (a similar mark, no legitimate interest, bad faith), attach evidence, pay the fee and send the complaint. WIPO charges USD 1,500 for one to five domains with a single panelist. **Wardmint** locks a domain within 2 business days of a request from a UDRP provider. ## UDRP fees at the two main providers *WIPO schedule read 12 November 2026. Forum figure from its fee schedule PDF, which carries no date: confirm before filing. Lawyer fees are extra.* | Provider | Domains in the complaint | Single panelist | Three panelists | | --- | --- | --- | --- | | WIPO | 1 to 5 | USD 1,500 | USD 4,000 | | WIPO | 6 to 10 | USD 2,000 | USD 5,000 | | WIPO, expedited service (notice of 9 March 2026) | 1 to 5 | USD 4,000 (single panelist only), decision targeted within one month | Not offered | | Forum | 1 to 2 | USD 1,330 | USD 2,660 | ## Five steps from evidence to decision 1. **Identify the registrar and the registrant data** — Find the registrar and the registration record with an RDAP or ICANN lookup, and check the language of the registration agreement. Registrant data is often redacted; the provider asks the registrar for it after filing. See how to check who owns a look-alike domain. 2. **Prove your rights in the mark** — Attach trademark registration certificates. Evidence of use (dated sales, press, token listings, a social following) supports a claim of unregistered rights; a panel decides whether it is enough. 3. **Gather evidence of bad faith** — Collect dated screenshots of the page, the use made of it (a wallet-signature request, a fake airdrop), archived copies, the creation date of the domain and any offer to sell it. 4. **Draft and pay** — Use the provider's model complaint. WIPO starts processing only after it receives the fee, and administrative fees are non-refundable once the complaint is registered. 5. **File and follow the clock** — Submit by email or the online form, with a copy to the registrar. The provider reviews the complaint for compliance, notifies the respondent, receives the response, appoints a panel and sends the decision. The registrar then waits ten business days before implementing a transfer. ## What are the three elements you must prove? **You must prove all three elements of paragraph 4(a) of the policy: a similar mark, no legitimate interest, and bad faith.** The policy text, published by ICANN, requires that the domain name is identical or confusingly similar to a trademark or service mark in which you have rights, that the registrant has no rights or legitimate interests in the name, and that the name has been registered and is being used in bad faith. Paragraph 4(b) lists circumstances that count as evidence of bad faith: registering to sell the name to the mark owner or a competitor above documented costs; registering to block the owner from reflecting the mark, as part of a pattern; registering to disrupt a competitor; and using the name to attract users for gain by creating confusion with your mark. The list is not exhaustive. A phishing page that copies your login falls in the last group, because it exploits confusion with your mark. ## How much does a UDRP complaint cost, and who decides? **WIPO charges USD 1,500 for one to five domains with a single panelist and USD 4,000 with three; Forum starts at USD 1,330 for one or two domains.** The table above has the full schedule. The fees are paid by the complainant at filing. The WIPO page is headed with a 2002 validity date but is the live schedule, so confirm the amount with the provider on the day you file. A single panelist is the cheaper option. Adding up the cost is the reason to read the [cost of defensive registration](https://wardmint.com/defensive-domain-registration-cost/ "How much does defensive domain registration cost?") before an incident: a set of your own variants costs less than one complaint. ## How long does a UDRP case take? **The rules set short steps, and a standard case runs for about two months from filing to implementation.** The sum below uses the ICANN rules: the provider checks the complaint and forwards it within three calendar days of receiving the fee; the respondent has 20 days to respond, with four extra calendar days available on request; the provider appoints a single panelist within five calendar days of the response; and the panel sends its decision within 14 days of appointment, absent exceptional circumstances. The provider communicates the decision within three business days, and the registrar waits ten business days after notice before it implements, unless the respondent shows it has sued in court. That adds up to roughly two months. WIPO's expedited service aims at a decision within one month from filing, at USD 4,000 for one to five domains. A UDRP gives two remedies only: cancellation or transfer of the domain. It awards no damages. ## What can you do while the case runs? **Ask the registrar to keep the domain locked, and keep reporting the site.** A UDRP provider asks the registrar to lock the domain once a complaint is filed. At Wardmint, a domain is locked within 2 business days of a request from a UDRP provider, and we release the data we hold only when Panamanian law requires it (a Panamanian court or prosecutor's order), or in a UDRP case. A UDRP is slower than an abuse report, so run both. The [take-down guide](https://wardmint.com/guides/take-down-a-phishing-site/ "How to take down a phishing site copying your dApp") shows the order of contacts, and [UDRP vs URS](https://wardmint.com/udrp-vs-urs/ "UDRP vs URS: which one to use against a phishing domain?") explains the faster procedure that applies to new extensions only. ## What does a defensive set cost against one complaint? **A defensive core set costs less per year than a single WIPO complaint.** According to Wardmint's survey of 12 November 2026, the core set of .com, .net, .org, .io, .xyz, .app costs $128.94 a year, against USD 1,500 for one WIPO filing with a single panelist; the three-year cost of the set is $386.82. A complaint recovers one domain you do not own; a set stops the next one from being free to register. Wardmint registers your own variants and does not run monitoring or legal filings. ## Questions about UDRP complaints ### Can I file a UDRP complaint without a registered trademark? Sometimes. The policy requires rights in a mark, and panels can accept unregistered rights when evidence of use is strong. WIPO Overview 3.1 summarizes panel views; a registered mark makes the first element simple. ### Does a UDRP complaint get me damages? No. The only remedies are cancellation or transfer of the domain name. Damages need a court. ### Which provider should I choose, WIPO or Forum? Both apply the same policy. WIPO lists USD 1,500 for one to five domains with one panelist, and Forum lists USD 1,330 for one or two domains in its undated schedule. Compare the current figures on filing day. ### Can the registrar transfer the domain at once if I win? No. The registrar waits ten business days after the provider's notice. It does not implement if the respondent shows it has filed a court action in a permitted jurisdiction. ### Is a UDRP faster than an abuse report? No. An abuse report can end a phishing site in hours or days. A UDRP gives you the domain, not just its silence, and takes about two months in a standard case. **In summary** - Prove three elements: a similar mark, no legitimate interest, bad faith. - WIPO charges USD 1,500 (1-5 domains, one panelist) or USD 4,000 (three panelists). - Forum lists USD 1,330 for one or two domains in an undated schedule. - Response 20 days, panel decision within 14 days of appointment, ten business days before implementation. - Remedies: transfer or cancellation only. - A core set of .com, .net, .org, .io, .xyz, .app costs $128.94 a year at Wardmint. - Wardmint locks a domain within 2 business days of a request from a UDRP provider. ## Sources 1. [Uniform Domain Name Dispute Resolution Policy](https://www.icann.org/resources/pages/policy-2012-02-25-en) — ICANN (read 2026-11-12) 2. [Rules for the UDRP](https://www.icann.org/resources/pages/udrp-rules-2015-03-11-en) — ICANN (read 2026-11-12) 3. [Schedule of fees under the UDRP](https://www.wipo.int/en/web/amc/domain-name-disputes/fees) — WIPO (read 2026-11-12) 4. [Domain name disputes: how to file](https://www.wipo.int/en/web/amc/domain-name-disputes) — WIPO (read 2026-11-12) 5. [UDRP fee schedule (undated PDF)](https://www.adrforum.com/assets/resources/domain/udrp/UDRP Fee Schedule Final.pdf) — Forum (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # How do you find look-alike domains of your brand? > Find look-alike domains of your brand with dnstwist, crt.sh and urlscan.io: three free tools, six steps, exact commands and a triage method. - URL: https://wardmint.com/guides/find-lookalike-domains-of-your-brand/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) Three free tools cover almost every look-alike of your own name: a permutation engine, the certificate logs and a public scanner. This guide gives the commands in the order to run them. **Quick answer — How do you find look-alike domains of your brand?** To find look-alike domains of your brand, generate permutations of your name with dnstwist, keep the registered ones with its --registered option, then cross-check certificate logs on crt.sh and scans on urlscan.io. All three are free. **Wardmint** sells the registrations that close the gaps you find: a .com costs $12.49/year. ## The three free tools, side by side *Prices and quotas as published by each tool, read on 12 November 2026.* | Tool | What it finds | Cost | Main limit | | --- | --- | --- | --- | | dnstwist | Typo, homoglyph, hyphen and extension-swap variants of a seed domain that are registered (open source, Apache-2.0) | Free | Only finds what its rules generate; a new word added to your name appears only if you give it a dictionary | | crt.sh | Certificates logged for any name containing your brand string, often before the site is live | Free | A site without HTTPS never appears; the wildcard search can return thousands of lines | | urlscan.io | Public scans that already loaded a page, with screenshots and the domains involved | Free plan with daily quotas, including 1,000 search requests; paid plans from USD 5,000 a year | Shows only pages someone scanned | ## Six steps from a brand name to a triaged list 1. **Write down your seed names** — List the exact spellings people type: the project name, the ticker, the app name and any short form. Each seed is searched on its own, so a project called ExampleCoin with the ticker EXC has at least two seeds. 2. **Install dnstwist** — The tool runs on Python and has a Docker image. The command is in the first code block below; the project page is the reference for other installers. 3. **List the registered variants** — Run dnstwist with --registered on each seed. The unfiltered output runs to thousands of lines of names nobody owns, so this option keeps only the names that resolve. 4. **Search the certificate logs** — Query crt.sh for your brand string with a wildcard on both sides. Every certificate issued for a name containing the string appears with its date. 5. **Search urlscan.io** — Ask for domains that start with your seed. Open the results page rather than the suspect site itself, so your own browser never touches the page. 6. **Triage into three piles** — Sort every name into: yours already, free to register for your brand, or held by someone else. The last pile goes to the ownership check and, if the page is hostile, to a report. *Step 2 and 3: install dnstwist and list registered variants of your own domain* ```bash pip install dnstwist[full] # registered variants of your own seed, as a readable table dnstwist --registered --format csv examplecoin.com | column -s, -t # the same, saved as JSON, then only the domain names dnstwist --registered --format json examplecoin.com > lookalikes.json jq -r '.[].domain' lookalikes.json ``` *Step 4: certificates containing your brand string (crt.sh)* ```bash curl -s "https://crt.sh/?q=%25examplecoin%25&output=json" | jq -r '.[].name_value' | sort -u ``` *Step 5: domains that start with your seed (urlscan.io search API)* ```bash curl -s -G "https://urlscan.io/api/v1/search/" \ --data-urlencode "q=page.domain.keyword:examplecoin*" \ --data-urlencode "size=100" ``` ## Why look for look-alikes before anyone reports them? **Because most phishing domains are registered by the attacker for the attack, so they exist before the first victim.** Interisle found that 77% of phishing domains in its May 2024 to April 2025 data were maliciously registered rather than compromised. Chainalysis reported that impersonation scams grew about 1,400% in 2025. A weekly search of your own name turns a surprise into a routine task. The search also tells you which variants are still free. A free variant is a registration you can make for your own brand, and a taken one is a candidate for the [ownership check](https://wardmint.com/guides/check-who-owns-a-lookalike-domain/ "How to check who owns a look-alike domain"). ## How does dnstwist generate and check variants? **dnstwist applies a fixed set of rules to your seed domain and asks DNS which results exist.** The rules cover the families described on the [look-alike domain types](https://wardmint.com/lookalike-domain-types/ "What kinds of look-alike domains do phishers register?") page: omitted or doubled letters, swapped neighbours, hyphens, look-alike characters and a different extension. Two more options matter for a crypto brand. The dictionary option adds permutations built from a word list, which is how you test names such as your brand followed by a word users search for. The TLD option checks your name under every extension in a file. Both take paths to files from the dictionaries folder of the dnstwist repository. Run the tool from a machine you can wipe or from a throwaway container: the output lists names you do not control. ## What do certificate logs add that DNS does not? **Certificate logs show a name before its site is advertised, because most phishing pages request an HTTPS certificate.** Each certificate issued by a public authority is written to a public log, and crt.sh searches those logs. In the February 2026 front-end hijack cluster tracked by Blockaid, the attacker obtained certificates the same day as the DNS change, including a wildcard for *.nerochain.io. A one-time search catches what exists today. For a standing watch, follow the [certificate transparency monitoring guide](https://wardmint.com/guides/monitor-certificate-transparency/ "How to monitor certificate transparency for your brand"), which uses the same logs as a feed. ## How do you triage what you find? **Sort every name by who holds it and what its page does, never by how close it looks.** A name that parks on an advertising page is a nuisance; a name that serves a copy of your login page is an incident. - **Free and valuable:** register it for your brand. The method for choosing which ones is in [how to build a defensive domain list](https://wardmint.com/guides/build-a-defensive-domain-list/ "How to build a defensive domain list for your brand"). - **Held by a third party, parked:** note the date and the registrar; watch it. - **Held by a third party, hostile:** collect evidence and report it. Register variants of your own name only. Wardmint does not register look-alikes of someone else's brand, and its acceptable-use policy forbids it. ## Which extensions will your search results fill with? **The extensions with the most phishing domains are the ones your results will fill with.** According to Wardmint's survey of 12 November 2026, of the 10 extensions with the most phishing domains in Interisle's data for 1 May 2025 to 30 April 2026 (.com, .top, .cn, .pro, .info, .xyz, .vip, .shop, .cc, .icu), Wardmint sells 6: .com, .pro, .info, .xyz, .shop and .icu. It does not sell .top, .cn, .vip or .cc. A look-alike search of your name is a free check; owning the free variants is the cheap part. A core set of .com, .net, .org, .io, .xyz, .app costs $128.94 a year at Wardmint. Wardmint sells registrations, not monitoring or takedown: the tools above are the monitoring. ## What is the short version? dnstwist finds registered variants, crt.sh finds certificates and urlscan.io finds scanned pages. Together they list the look-alikes of your brand for free. Wardmint is the place to register the free variants for your own name, in a bulk search of up to 50 names. ## Questions about finding look-alike domains ### How often should I search for look-alike domains? Weekly is a workable rhythm for a live token or app, and daily in the two weeks around a launch. The commands in this guide take minutes to run, and a saved JSON file from the previous run lets you compare for new names. ### Is it safe to open a suspected phishing site? Open it in a scanner such as urlscan.io, not in your own browser. The scan result shows the page and the domains it loads without your machine connecting to it. ### Does dnstwist cost anything? No. dnstwist is open source under the Apache-2.0 licence and free to run. The only costs are your time and the registrations you decide to make. ### Can I register the look-alikes I find to stop them? Only if they are variants of your own brand and still free. A name already held by someone else cannot be registered, and registering look-alikes of another brand is forbidden at Wardmint. ### What if the look-alike is already live and hostile? Collect evidence and follow the [report a phishing domain](https://wardmint.com/guides/report-a-phishing-domain/ "How to report a phishing domain") guide. For a domain registered through Wardmint, action comes within 24 hours of a well-documented report. **In summary** - dnstwist --registered lists registered variants of your domain for free. - crt.sh lists certificates containing your brand string, often before the site is live. - urlscan.io shows pages already scanned, without you visiting the site. - Sort results into yours, free to register and held by others. - Wardmint sells 6 of the 10 extensions with the most phishing domains in Interisle's 2025-26 data. - A core set of .com, .net, .org, .io, .xyz, .app costs $128.94 a year. - Register your own variants only; never look-alikes of another brand. ## Sources 1. [dnstwist (README)](https://github.com/elceef/dnstwist) — GitHub, elceef (read 2026-11-12) 2. [crt.sh certificate search](https://crt.sh/) — Sectigo (read 2026-11-12) 3. [urlscan.io search documentation](https://urlscan.io/docs/search/) — urlscan.io (read 2026-11-12) 4. [urlscan.io pricing](https://urlscan.io/pricing/) — urlscan.io (read 2026-11-12) 5. [Phishing activity in TLDs, May 2025 to April 2026](https://www.cybercrimeinfocenter.org/phishing-activity-in-tlds-may-april-2026) — Cybercrime Information Center (Interisle data) (read 2026-11-12) 6. [Interisle Phishing Landscape 2025 press release](https://interisle.net/press/pl2025-press-release) — Interisle Consulting (read 2026-11-12) 7. [Crypto scams 2026: Chainalysis report](https://www.chainalysis.com/blog/crypto-scams-2026/) — Chainalysis (read 2026-11-12) 8. [Front-end hijacking and the Web2 attack surface](https://blockaid.io/blog/frontend-hijacking-and-the-web2-attack-surface-threatening-web3-protocols) — Blockaid (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # What should you do when a phishing site impersonates your project? > First-hour checklist when a phishing site impersonates your crypto project: confirm, warn users, report in parallel, and rotate access. - URL: https://wardmint.com/guides/handle-a-domain-impersonation-incident/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) The first hour decides how many users sign the wrong request. This checklist separates a look-alike site from a hijack of your own domain, then orders the warnings, the reports and the follow-up. **Quick answer — What should you do when a phishing site impersonates your project?** When a phishing site impersonates your project, first check whether your own domain still resolves correctly, then warn users from verified channels with your real address, report the site to its registrar and host in parallel, and rotate any access an attacker could hold. Chainalysis counted impersonation scams up about 1,400% in 2025. **Wardmint** acts within 24 hours of a well-documented report. ## The first hour, minute by minute *A working schedule, not a guarantee of any outcome.* | Window | Action | Owner | | --- | --- | --- | | 0 to 10 minutes | Confirm the fake, check your own DNS, name an incident lead | Security lead | | 10 to 25 minutes | Post a warning on every verified channel with the real address; pause any signing campaign | Community lead | | 25 to 40 minutes | Send the evidence pack to registrar and host; flag the URL on warning lists | Security lead | | 40 to 60 minutes | Check registrar account access, rotate passwords and 2FA, review DNS records | Ops lead | | After the first hour | Track reports, update users, decide on a UDRP complaint | Incident lead | ## The first-hour checklist 1. **Separate a look-alike from a hijack** — Run the DNS check below. A look-alike is a different domain; users who typed or clicked wrongly landed there. A hijack means your own domain now points elsewhere, and the case is an emergency at your registrar. 2. **Name one incident lead** — One person owns the timeline, the evidence folder and every outbound message. Others execute; they do not freelance. 3. **Warn users from channels they trust** — Post the real address on your site banner, social accounts, community server and wallet-integration channels. Say plainly: never sign a request from any other address. Write the fake address defanged, such as example[.]com, so nobody clicks it. 4. **Start the reports in parallel** — Registrar and host first, then Safe Browsing, Netcraft, Chainabuse and wallet blocklists. The report guide has the RDAP commands. 5. **Lock down your own access** — Review the registrar account, DNS provider and hosting logins. Rotate passwords, replace SMS 2FA with a hardware key, and check the DNS records line by line. See how to protect your registrar account from takeover. 6. **Help users who already signed** — Tell them to move remaining funds to a new wallet, to review and revoke token approvals with a block-explorer approval checker, and to send you the transaction hash. Do not promise a refund in the first message. *Step 1: is your own domain still pointing where it should?* ```bash dig +short NS yourdomain.com dig +short A yourdomain.com dig +short TXT yourdomain.com curl -sL https://rdap.org/domain/yourdomain.com | jq '{status: .status, nameservers: [.nameservers[].ldhName], changed: [.events[] | select(.eventAction=="last changed") | .eventDate]}' # compare with the values you recorded in your runbook; a changed nameserver or a new "last changed" date you did not make is a hijack ``` ## How do you tell a look-alike site from a hijack of your own domain? **If your domain still resolves to your servers and its nameservers are yours, the fake lives on another domain.** The check takes under a minute with the commands above. A look-alike means the attacker owns a different domain and relies on users mistyping, clicking an ad or following a link. A hijack is different. On 12 May 2025 Curve Finance's domain was redirected at the registrar level at about 20:55 UTC; the team found it at 21:20 UTC and told users to use curve.finance as an interim address, and said that contracts and user data were not affected. On the evening of 30 October 2026, domains of about a dozen DeFi front ends registered with Name.com were redirected to a drainer kit, and The Block reported that ten domains were suspended at 8:32 a.m. Eastern Time the next morning. In a hijack, call your registrar before anything else. ## What should the warning to users say? **A good warning gives the real address, says what to refuse, and names no one as guilty.** Keep it to four lines: what happened, the one official address, the instruction to reject any signature request from another address, and the time of the next update. Do not link the fake site. Do not guess at losses. Curve's May 2025 notice is a model of the form: it said what was redirected, which address to use, and that contracts were untouched. Pin the notice on every channel and edit it in place when facts change, with the time of each edit. The longer-term step is a [defensive set of your own variants](https://wardmint.com/defensive-domain-registration/ "What is defensive domain registration?") so that the obvious fakes are not for sale to an attacker. ## What do you do about the reports and the evidence? **Send one evidence pack to every recipient the same hour.** The pack holds the URL, dated screenshots, the signature request, receiving wallet addresses and the RDAP output. The full order of contacts is in [how to take down a phishing site copying your dApp](https://wardmint.com/guides/take-down-a-phishing-site/ "How to take down a phishing site copying your dApp"). Keep a log of every report with its time, recipient and reference number. A later UDRP complaint, an ICANN Compliance complaint or a police report starts from that log. Drainer losses are large: ScamSniffer counted 106,106 victims and USD 83.85 million in wallet-drainer losses on EVM chains in 2025, so a clean log helps users who file their own reports. ## How much does preparation change the first hour? **A written runbook saves the minutes you cannot spare.** According to Wardmint's survey of 12 November 2026, its research file holds four hijack entries with a primary source since July 2024: the Squarespace wave (July 2024), Curve Finance (May 2025), a five-project cluster (February 2026) and Name.com customers (October 2026). Each source ties the attack to the domain, registrar or DNS layer rather than to smart contracts, although the October 2026 cause is disputed between Name.com and Vercel. Write down, before you need it: the registrar login owner, where 2FA keys are kept, the DNS records you expect, and the contact for each channel. For hardening before an incident, see [how to secure your domain against DNS hijacking](https://wardmint.com/guides/secure-domain-against-dns-hijacking/ "How to secure your domain against DNS hijacking"). Support at Wardmint: email replies within 12 hours, 7 days a week, including help with DNSSEC, CAA records and abuse reports. ## Questions about impersonation incidents ### Should I take my real site offline during an incident? Only if your own domain is hijacked or compromised. For a look-alike on another domain, keep your site up and make the real address more visible. ### Should I announce the incident publicly? Yes, once you have confirmed it. Users sign the fake request in the minutes before they hear of it, so a short factual notice from verified channels does more good than a complete report written later. ### Can users get their funds back? Do not promise it. Tell users how to protect remaining funds and ask them to share transaction hashes; recovery depends on the chain, the drainer and any law enforcement action. ### How soon will the registrar act on my report? No timeline binds all registrars. ICANN has required accredited registrars to act promptly on actionable evidence of phishing since 5 April 2024. At Wardmint, action comes within 24 hours of a well-documented report. **In summary** - Check your own DNS first: a look-alike and a hijack need different calls. - Warn users from verified channels with the real address and no live link to the fake. - Send registrar and host reports in parallel with one evidence pack. - Rotate registrar, DNS and hosting access and move to hardware 2FA. - Chainalysis counted impersonation scams up about 1,400% in 2025. - ScamSniffer counted USD 83.85 million lost to wallet drainers on EVM chains in 2025. - Wardmint acts within 24 hours of a well-documented report. ## Sources 1. [Curve domain incident](https://news.curve.finance/curve-domain-incident/) — Curve Finance (read 2026-11-12) 2. [Hackers hijack a dozen DeFi websites, all registered with Name.com](https://theblock.co/news/defi/2026-10-31-hackers-hijack-a-dozen-defi-websites-all-registered-with-name-com-and-steal-about-138000-432251) — The Block (read 2026-11-12) 3. [Crypto scams 2026: Chainalysis report](https://www.chainalysis.com/blog/crypto-scams-2026/) — Chainalysis (read 2026-11-12) 4. [ScamSniffer 2025 report: crypto phishing losses fall 83% to $84 million](https://drops.scamsniffer.io/scam-sniffer-2025-crypto-phishing-losses-fall-83-to-84-million/) — ScamSniffer (read 2026-11-12) 5. [Front-end hijacking and the Web2 attack surface](https://blockaid.io/blog/frontend-hijacking-and-the-web2-attack-surface-threatening-web3-protocols) — Blockaid (read 2026-11-12) 6. [Researchers: weak security defaults enabled Squarespace domains hijacks](https://krebsonsecurity.com/2024/07/researchers-weak-security-defaults-enabled-squarespace-domains-hijacks/) — Krebs on Security (read 2026-11-12) 7. [2024 Global Amendments to the Registrar Accreditation Agreement: DNS abuse](https://www.icann.org/resources/pages/global-amendment-2024-en) — ICANN (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # How do you monitor certificate transparency for your brand? > Monitor Certificate Transparency by searching crt.sh and streaming CertStream for your brand name to spot look-alike certificates early. - URL: https://wardmint.com/guides/monitor-certificate-transparency/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) Certificate Transparency logs are public records of issued certificates. Watching them for your brand name shows look-alike sites, and hijacked domains, often before users see them. **Quick answer — How do you monitor certificate transparency for your brand?** Monitor Certificate Transparency by searching crt.sh for your domain and brand name on a schedule, and by streaming new log entries from CertStream and matching them against your brand keywords. **Wardmint** counted that 6 of the 10 extensions with the most phishing domains in Interisle's 2025-2026 data are sold by Wardmint, so those are the first endings to match. ## Free ways to watch certificate logs | Tool | How it works | Best for | Cost | | --- | --- | --- | --- | | crt.sh | Web search over Certificate Transparency logs, run by Sectigo | Ad hoc checks and a weekly look at your own domains | Free | | CertStream | Real-time stream of new log entries, matched by your own code | Catching a look-alike certificate within minutes | Free | | dnstwist | Generates typo and look-alike names you can then search in the logs | Building the list of strings to watch | Free, open source | | urlscan.io | Records what a URL loads, with a free API plan | Checking what a suspicious name actually serves | Free tier, paid plans | ## What is Certificate Transparency, and why does it help a crypto project? **Certificate Transparency is a system of public logs in which certificate authorities record the certificates they issue.** Because the logs are public, anyone can search them for a name, including a name that imitates yours. A phisher who wants HTTPS on a look-alike domain usually requests a certificate, and that request becomes a visible entry. This matters for two situations. The first is the look-alike domain: an attacker registers a name that resembles yours, obtains a certificate and starts a campaign. The second is the hijack: Blockaid reported that in the February 2026 front-end compromises the attacker's SSL certificates were issued the same day as the DNS change, and that wildcard certificates were issued for the Nerochain domain. A log entry for your own domain that you did not request is an early warning. A citable definition: Certificate Transparency monitoring is the practice of searching public certificate logs for names that contain your brand, so that look-alike and hijack certificates are seen when they are issued, not when users are hurt. ## How do you search crt.sh for your brand? **Search crt.sh by identity, using your domain name and your brand string, and review the list weekly.** crt.sh is a certificate search service operated by Sectigo. It accepts a domain name or organisation name as an identity, a certificate fingerprint or a crt.sh ID. Its Advanced page lists the match operators Autoselect, equals, ILIKE and LIKE, a scope choice, a checkbox to exclude expired certificates and one to deduplicate certificate and precertificate pairs. The LIKE operators are SQL operators, in which the percent sign matches any text, so a pattern such as the brand with a percent sign on each side lists names that contain it. crt.sh's page does not document the pattern characters, so confirm the behaviour with a test search on a name you own. Record what you find. Keep a short list of your own legitimate names and issuers, and review every other entry. For each look-alike name, take the next steps from [how to find look-alike domains of your brand](https://wardmint.com/guides/find-lookalike-domains-of-your-brand/ "How to find look-alike domains of your brand"). ## How do you stream new certificates with CertStream? **CertStream delivers new Certificate Transparency entries in real time, and a short script flags the ones that match your brand.** It is fast but noisy, because most certificates are unrelated, so the matching rule decides how useful it is. The Python library installs with pip. Its README registers a callback that receives a message and a context, checks that the message type is certificate_update and reads the list of domains from the leaf certificate. The sample below follows that structure and adds a brand match. *Flag certificates that contain your brand* ```python # pip install certstream import certstream BRAND = 'examplecoin' def on_cert(message, context): if message['message_type'] == 'certificate_update': for name in message['data']['leaf_cert']['all_domains']: if BRAND in name.lower(): print(name) certstream.listen_for_events(on_cert, url='wss://certstream.calidog.io/') ``` ## Which strings and endings should you watch? **Watch your exact brand, its common misspellings and the brand combined with words like login, claim, airdrop or wallet.** Use dnstwist, an open-source permutation engine, to generate typo, homoglyph, hyphenation and extension-swap variants of your name, and feed those strings to your matcher. Weight the endings by abuse data. According to Wardmint's survey of 12 November 2026, 6 of the 10 extensions with the most phishing domains in Interisle's data for 1 May 2025 to 30 April 2026 are sold by Wardmint: .com (869,180 domains), .pro (130,945), .info (99,602), .xyz (93,987), .shop (79,625) and .icu (74,786). The other four are .top, .cn, .vip and .cc. Wardmint does not sell .top. Owning the endings you sell ahead of time removes the matches an attacker could otherwise take. Count is not risk. Interisle's phishing score, per 10,000 delegated domains, puts .icu at 1,607 and .pro at 1,200.1 against 53.7 for .com, so a hit on a small, abused ending deserves a faster look than one on .com. The list and scores are in [which domain extensions are most used for phishing](https://wardmint.com/most-abused-tlds-for-phishing/ "Which domain extensions are most used for phishing?"). ## How to set up certificate monitoring in five steps 1. **Write down your own names and issuers** — List every domain and subdomain you use and the authority that issues for each. Anything else in the logs is worth reading. 2. **Generate the watch list** — Run dnstwist on your main domain to produce look-alike names, and add your brand with trigger words such as login or claim. 3. **Search crt.sh weekly** — Search your domain and brand as identities, exclude expired certificates and review new entries. 4. **Run CertStream for real time** — Deploy the script on any small server, send matches to an email address or channel that a person reads. 5. **Decide in advance what a hit triggers** — For a look-alike, collect evidence and report it; for an unexpected certificate on your own name, treat it as a possible hijack and follow the incident steps. ## What do you do when a suspicious certificate appears? **Check the name, record the evidence and act in the order that fits the case.** For a look-alike name, load it safely, take screenshots, save the certificate entry and the page, and run the report steps. For an unexpected certificate on your own domain, verify your DNS records and registrar account first, because it may mean someone changed where your domain points. The response plan is in [what to do when a phishing site impersonates your project](https://wardmint.com/guides/handle-a-domain-impersonation-incident/ "What to do when a phishing site impersonates your project"). A CAA record limits which authorities can issue for your own names, as described in [how to set up CAA records](https://wardmint.com/guides/set-up-caa-records/ "How to set up CAA records"). Wardmint registers domains and DNS records; it does not run monitoring or takedown services, which is why this guide uses free tools. ## Questions about certificate monitoring ### Does every phishing site get a certificate? No. A phishing page over plain HTTP needs none, and some use certificates from authorities whose logs you may not watch. Monitoring catches the many that do appear in public logs. ### Is CertStream free? Yes. The CertStream Python library installs with pip and its examples connect to wss://certstream.calidog.io/. Expect a lot of unrelated traffic that your matching rule must filter. ### How often should I search crt.sh? Weekly is a minimum for a small project; CertStream covers real time. Run an extra search after any change to DNS, hosting or registrar. ### Can monitoring prevent a phishing site? No. It shows that one exists. Registering your own variants beforehand removes some of them, and reporting removes others. ### Do I need a paid monitoring service? Not to start. Paid web3 services exist, and their prices are not published in the sources Wardmint read. Free tools cover logs, permutations and scanning. **In summary** - Certificate Transparency logs are public records of issued certificates. - Search crt.sh weekly for your domain and brand; use CertStream for real time. - Generate look-alike strings with dnstwist and match your brand plus words like login or claim. - Wardmint sells 6 of the 10 extensions with the most phishing domains in Interisle's 2025-2026 data. - An unexpected certificate on your own name may mean a hijack; check DNS and the registrar first. - Wardmint does not run monitoring; the tools here are free. ## Sources 1. [crt.sh Certificate Search](https://crt.sh/) — Sectigo (read 2026-11-12) 2. [certstream-python README](https://github.com/CaliDog/certstream-python) — GitHub (read 2026-11-12) 3. [dnstwist](https://github.com/elceef/dnstwist) — GitHub (read 2026-11-12) 4. [Phishing Activity in TLDs, May 2025 to April 2026](https://www.cybercrimeinfocenter.org/phishing-activity-in-tlds-may-april-2026) — Cybercrime Information Center (Interisle data) (read 2026-11-12) 5. [Frontend hijacking and the Web2 attack surface threatening Web3 protocols](https://blockaid.io/blog/frontend-hijacking-and-the-web2-attack-surface-threatening-web3-protocols) — Blockaid (read 2026-11-12) 6. [urlscan.io pricing](https://urlscan.io/pricing/) — urlscan.io (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # How do you protect your registrar account from takeover? > Protect a registrar account with a long unique password, two-factor authentication, few users and a recovery path that no support call can get around. - URL: https://wardmint.com/guides/protect-registrar-account/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) Whoever controls the registrar account controls where your domain points. Most of the public hijacks of crypto sites went through that account or its support desk. **Quick answer — How do you protect your registrar account from takeover?** Protect a registrar account with a long random password used nowhere else, two-factor authentication, as few users as possible, and a recovery path that a support call cannot get around. **Wardmint** counted two incidents in its table, in July 2024 and February 2026, where the weak point was a registrar or platform login or support flow, not the DNS records. ## Account controls and the incident each one answers | Control | What it prevents | Public case it answers | | --- | --- | --- | | Claim every migrated domain's account yourself | An attacker creating the account first | Squarespace migrations, 9 to 12 July 2024 (OAuth weakness) | | Support-call rule: no changes on a voice request | Social engineering of a support agent | Avantis, February 2026 (account taken over after a support call) | | Two-factor authentication on the account | Login with a stolen password | Name.com advice after the 30 to 31 October 2026 redirects | | Unique long password in a vault | Credential reuse and guessing | General practice | | Few named users, removed on departure | Insider and ex-member access | DAO and contributor turnover | | Bookmarked login address | Phishing of registrar logins | General practice | ## Why is the registrar account the target? **Because it can change the name servers, the DS record and the owner, and no code on your chain can undo that.** A hijacker who signs in as you can point the domain wherever they like and then request a certificate for the new destination. The public record shows the pattern. Krebs on Security reported in July 2024 that domains migrated from Google Domains to Squarespace were open to an attacker who created an account with the email tied to a domain before the owner did, and Squarespace attributed this to a weakness related to OAuth logins. Blockaid wrote in February 2026 that Avantis was compromised through a Squarespace account taken over after billing details were extracted in a support call. On 30 and 31 October 2026, domains of a dozen DeFi sites registered at one registrar were redirected; the registrar restored them and urged DNS checks and two-factor authentication. According to Wardmint's count of 12 November 2026, two of the seven incidents in its table (the July 2024 wave and the Avantis case in February 2026) pivot on a login or support flow at a registrar or platform. The full set is in [which crypto projects lost users to DNS hijacking](https://wardmint.com/dns-hijacking-crypto-incidents/ "Which crypto projects lost users to DNS hijacking?"). ## What password and login setup should you use? **Use a random password of at least 20 characters, generated and stored by a password manager, and never reuse it.** A shared chat message or a spreadsheet is not a vault. If more than one person needs access, use a team vault with an audit trail, and record who has seen the secret. Turn on two-factor authentication for the account. A hardware security key is the strongest common second factor, because it does not hand a code to a phishing page. An authenticator app is the next choice; a code sent by text message is the weakest. Store recovery codes offline, in two places, and write down who can reach them. On Wardmint, you sign in with an account number and password, and you can turn on two-factor authentication in the client area; email replies within 12 hours, 7 days a week, including help with DNSSEC, CAA records and abuse reports. Because only one verified email per domain is needed for the registration itself, keep the account email on a mailbox you control and protect that mailbox as strictly as the account. ## Who should have access, and how do you handle a support call? **Name one owner and one backup, document both, and write a rule that no change is made on the strength of a call.** The Avantis case shows why. If support can change an account after a phone conversation, then the strength of your password no longer matters. For a DAO or foundation, decide in advance who holds the credentials, how the treasury tops up the balance and how access changes when a contributor leaves. The practices for shared custody are in [how should a DAO hold and pay for its domains](https://wardmint.com/dao-domain-security/ "How should a DAO hold and pay for its domains?"). Remove access the same day someone leaves the team, and change the shared password then. For the most important domains, consider Domain protection at +$29/year per domain: the domain is registered in the name of DomaineGoat LLC, you remain the beneficiary with a free hand-back to your own name, a transfer lock is on, and every complaint is read by a person before any action. The option is described in [what is Domain protection](https://wardmint.com/domain-protection/ "What is Domain protection for a brand's domains?"). It reduces what the account holds, and it does not replace a strong login. ## How to protect a registrar account in seven steps 1. **Inventory every account and domain** — List each registrar account, the domains in it and the people who can sign in. Include accounts inherited from migrations. 2. **Claim migrated accounts** — If a registrar absorbed your old one, sign in and confirm that you, not a stranger, hold the account for each domain. 3. **Replace the password** — Generate a random password of 20 characters or more in a vault and use it only for this account. 4. **Turn on two-factor authentication** — Prefer a hardware key, then an authenticator app. Store recovery codes offline in two places. 5. **Reduce and record access** — Name one owner and one backup, remove everyone else and note the date and reason for each change. 6. **Write the support-call rule** — Agree that nobody changes DNS, owner or contacts on the strength of a call or chat, and tell your team. 7. **Bookmark the login and watch for phishing** — Open the registrar only from your bookmark. Treat any email asking you to log in to a registrar as a possible phishing attempt. ## How do you spot a phishing page that copies your registrar? **Check the address before you type anything, and never follow a login link from an email.** Registrar phishing relies on urgency: a message says the domain is about to expire or has a complaint. Open the registrar from your bookmark and look for the same notice in the account. Use a password manager that fills credentials only on the exact saved address, so a look-alike login page gets nothing. Hardware keys add the same protection to the second factor. If you ever enter a password on a doubtful page, change it at once, end all sessions and review the DNS records and the contact email. A second layer is expiry. A domain that lapses can be taken by anyone, and the renewal duty is covered in [how to stop your domains from expiring](https://wardmint.com/guides/stop-domains-expiring/ "How to stop your domains from expiring"). The wider hardening plan is in [how to secure your domain against DNS hijacking](https://wardmint.com/guides/secure-domain-against-dns-hijacking/ "How to secure your domain against DNS hijacking"). ## Questions about registrar account security ### Is two-factor authentication enough? It is necessary but not enough alone. The Avantis case went through a support call. Add a no-changes-by-call rule and few users. ### Does a transfer lock protect the account? No. It stops transfers to another registrar. It does not stop someone with the login from changing name servers or records. ### Should the account use a shared team email? Use a mailbox the team controls, protected with two-factor authentication, not a personal address of one member. Each domain also needs one verified email for its registration. ### What if a contributor with access leaves? Change the password, remove their access, rotate recovery codes and review the DNS records, all on the same day. ### Can Domain protection replace a strong login? No. It puts the domain in the name of the company and adds human review of complaints, and the account still needs a strong login. **In summary** - The registrar account can change name servers, DS records and the owner. - Public hijacks of 2024 and 2026 went through a login weakness or a support call. - Use a random password of 20 characters or more, in a vault, used nowhere else. - Turn on two-factor authentication, preferably with a hardware key. - Name one owner and one backup; remove leavers the same day. - Write a rule that no change is made on a call alone. - Domain protection costs +$29/year and does not replace a strong login. ## Sources 1. [Researchers: weak security defaults enabled Squarespace domains hijacks](https://krebsonsecurity.com/2024/07/researchers-weak-security-defaults-enabled-squarespace-domains-hijacks/) — Krebs on Security (read 2026-11-12) 2. [Frontend hijacking and the Web2 attack surface threatening Web3 protocols](https://blockaid.io/blog/frontend-hijacking-and-the-web2-attack-surface-threatening-web3-protocols) — Blockaid (read 2026-11-12) 3. [Hackers hijack a dozen DeFi websites registered with Name.com](https://theblock.co/news/defi/2026-10-31-hackers-hijack-a-dozen-defi-websites-all-registered-with-name-com-and-steal-about-138000-432251) — The Block (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # How do you redirect defensive domains to your main site? > Point each defensive domain at your main site with a permanent 301 redirect over HTTPS, and test it with curl; Wardmint's URL forwarding is free. - URL: https://wardmint.com/guides/redirect-defensive-domains/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) A defensive domain is only useful if a user who types it lands on your real site. A permanent redirect over HTTPS does that and leaves nothing for a phisher to reuse. **Quick answer — How do you redirect defensive domains to your main site?** Redirect each defensive domain, and its www name, to your main site's HTTPS address with a permanent 301 redirect, then confirm the result with `curl -I`. **Wardmint** includes free URL forwarding for every domain, so the six-extension core set at $128.94 a year costs an average of $21.49 per extension with the forwarding included. ## Ways to send a defensive domain to your main site | Method | How it works | Needs a server | HTTPS on the defensive name | Fit | | --- | --- | --- | --- | --- | | URL forwarding at the registrar | The registrar's service answers with a redirect | No | Depends on the service; test it | Most defensive domains | | Redirect on your own web server | A server rule returns a 301 to the main site | Yes | Yes, with a certificate you manage | Domains that need full control | | DNS-only (A or CNAME to your host) | The name points to your host, which then redirects | Yes, at your host | Yes, if the host issues a certificate | Hosts that already serve many names | | No redirect, parked with no email | The name resolves to nothing and sends no mail | No | Not applicable | Names you only want to hold | ## Why should a defensive domain redirect at all? **A redirect turns a typing mistake into a visit to your real site, and it stops the name from being an empty slot.** Users mistype addresses, follow a link written without care or reach a variant through search. If the variant is yours and answers, the user ends on the official site. A redirecting domain also helps with trust. A defensive name that shows an error page looks abandoned, and an abandoned look-alike is hard to explain to a user. One that always lands on the official site teaches users that the address belongs to you. The redirect is the web half of the job. The mail half is a separate set of records, covered in [how to stop email spoofing on unused domains](https://wardmint.com/guides/stop-email-spoofing-on-unused-domains/ "How to stop email spoofing on unused domains"). Wardmint describes the whole defensive approach in [how to protect your brand from typosquatting](https://wardmint.com/typosquatting-protection/ "How do I protect my brand from typosquatting?"). ## Which redirect type should you use? **Use a permanent redirect: status 301 Moved Permanently, or 308 Permanent Redirect.** Both exist in RFC 9110, which defines HTTP semantics, and both tell clients that the resource now lives at the address in the Location header. A permanent redirect suits a defensive domain, because the relationship is meant to last. A temporary redirect (302 or 307) tells clients to keep checking the old address, which fits a campaign page and not a standing variant. Always send the user to the final address, the HTTPS address of your canonical main site, in one step. A chain of two or three redirects gives an attacker more places to insert themselves and slows the user. Send the user to the main page, or to a page that exists. Never redirect a defensive domain to a page that asks for a wallet connection or a signature, since a typo should end on an information page and not on a transaction. Wardmint offers free URL forwarding and email forwarding from the client area. ## Why does HTTPS matter on a domain that only redirects? **Because a redirect sent over plain HTTP can be altered on the way.** A user who types your variant may reach the HTTP version first. If that HTTP response is the redirect, anyone on the network path can change the Location header, so the safe design answers on HTTPS with a valid certificate for the defensive name. That has a consequence for CAA records. A redirecting defensive domain needs a certificate, so its CAA set must allow the authority that issues it, while a parked domain that serves nothing can forbid issuance. The syntax is in [how to set up CAA records](https://wardmint.com/guides/set-up-caa-records/ "How to set up CAA records"). If you forward through a service, test the HTTPS name before you rely on it, since support differs between services. According to Wardmint's survey of 12 November 2026, the core set of .com, .net, .org, .io, .xyz, .app costs $128.94 a year for six domains, an average of $21.49 each, and the forwarding is free for all six. ## How to redirect a defensive domain in six steps 1. **Choose the destination** — Pick the exact HTTPS address of your main site, including whether it uses www, and use that address for every defensive name. 2. **Set up forwarding** — In the client area, set URL forwarding for the domain to the destination. Repeat for the www name of the domain. 3. **Use a permanent redirect** — Where the service lets you pick, choose a permanent redirect (301). If you redirect on your own server, return 301 with a Location header. 4. **Check the certificate** — Open the defensive name over HTTPS and confirm that the browser shows no warning before it redirects. 5. **Test with curl** — Run curl -I against the http and https versions of the domain and its www name, and read the status and the Location header. 6. **Add the no-email records** — Publish the null MX, SPF and DMARC records so the redirecting domain cannot be used to spoof mail. *Test the redirect* ```bash curl -sI http://example-variant.com | head -n 5 curl -sI https://example-variant.com | head -n 5 curl -sI https://www.example-variant.com | head -n 5 ``` ## What mistakes break a defensive redirect? **The common mistakes are a missing www name, a redirect chain and a forgotten expiry.** Many users type www, so forward both the bare name and the www name. Redirect straight to the final address, not through a second defensive domain. The third mistake is letting the domain lapse. A defensive name that expires can be registered by someone else, and a redirect that once protected users becomes a trap. Turn on automatic renewal from your balance and keep it funded, as described in [how to stop your domains from expiring](https://wardmint.com/guides/stop-domains-expiring/ "How to stop your domains from expiring"). Finally, keep a list of every defensive domain and its destination, so that a change of main address updates all of them. The method for building the list, with budgets, is in [how to build a defensive domain list for your brand](https://wardmint.com/guides/build-a-defensive-domain-list/ "How to build a defensive domain list for your brand"). ## Questions about redirecting defensive domains ### Is a 301 or a 302 better for a defensive domain? A 301 is better, because the relationship is permanent. A 302 tells clients the move is temporary, which fits short campaigns. ### Do I need hosting for each defensive domain? No. URL forwarding at the registrar answers without a server. Use your own server only if you need control over the response. ### Should defensive domains redirect to the home page or to a specific page? Send them to the home page or an information page. Avoid pages that ask for a wallet connection or a signature. ### Does Wardmint charge for URL forwarding? No. Free URL forwarding is included with every domain, and it can be combined with the no-email DNS template. ### What if I do not want any web traffic on a defensive name? Leave it parked with no web service and publish the no-email records. Consider a CAA record that forbids issuance. **In summary** - A defensive domain should land users on your real site in a single permanent redirect. - Use a 301 (or 308) to the HTTPS address of your canonical main site. - Redirect both the bare name and the www name. - A redirecting domain needs a certificate; a parked one can forbid issuance with CAA. - Test with curl -I on http, https and www. - Wardmint's URL forwarding is free; the core set averages $21.49 per extension. - Add the no-email records and keep auto-renew on. ## Sources 1. [RFC 9110: HTTP Semantics](https://www.rfc-editor.org/rfc/rfc9110.html) — IETF / RFC Editor (read 2026-11-12) 2. [RFC 8659: DNS Certification Authority Authorization (CAA) Resource Record](https://www.rfc-editor.org/rfc/rfc8659.html) — IETF / RFC Editor (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # How do you report a phishing domain? > Report a phishing domain to its registrar, host and blocklists: an RDAP lookup finds the abuse contact; ICANN rules in force since 5 April 2024. - URL: https://wardmint.com/guides/report-a-phishing-domain/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) Reporting works in two layers: the parties who can switch the site off, and the lists that warn users while it is still up. Send both, in this order. **Quick answer — How do you report a phishing domain?** To report a phishing domain, look up its registrar and abuse contact with an RDAP query, send a documented report there, then tell the web host and flag the URL with Google Safe Browsing, Netcraft, Chainabuse and MetaMask's blocklist. Since 5 April 2024, ICANN rules oblige registrars to act on actionable evidence; **Wardmint** acts within 24 hours of a well-documented report. ## Who to tell, and what each one can do *Read on 12 November 2026 from the services' own pages and the ICANN amendment.* | Recipient | What it can do | How to reach it | | --- | --- | --- | | Registrar of the domain | Suspend or lock the domain; ICANN-accredited registrars must act promptly on actionable evidence of phishing | Abuse address or webform from the RDAP record | | Web host or CDN of the site | Remove the page or the account that serves it | Abuse contact of the IP network, from an RDAP IP query | | Google Safe Browsing | Flag the page so supporting browsers show a warning | Report a Page form at safebrowsing.google.com | | Netcraft | Take the URL into its phishing and malware reporting service | report.netcraft.com | | MetaMask eth-phishing-detect | Add the domain to the open blocklist MetaMask uses | Pull request to the GitHub repository | | Chainabuse | Publish a community report that others can search | Report a Scam on chainabuse.com | ## Seven steps from a suspect URL to filed reports 1. **Build the evidence pack** — Save the full URL, a dated screenshot, the page source if you can capture it safely, the wallet addresses it asks you to sign for and the urlscan.io result link. Write the URL with the dots defanged (example[.]com) in emails so mail filters do not strip it. 2. **Look up the registrar** — Run the RDAP query below. It returns the registrar name, the creation date, the name servers and, in most records, the registrar abuse contact. 3. **Find the web host** — Resolve the domain to an IP address and query RDAP for that address. The abuse contact of the network owner is the host to notify. 4. **Send the registrar report** — State the URL, the brand it copies, why it is phishing (a wallet-signature request, a seed-phrase form) and attach the evidence. Ask for suspension and ask for the reference number. 5. **Send the host report** — Send the same pack to the host. A host can remove the page even if the registrar is slow. 6. **Flag the URL on the warning lists** — File the URL with Google Safe Browsing and Netcraft, and add a report on Chainabuse. For wallet users, open a pull request to MetaMask's blocklist. 7. **Log the references and the dates** — Note each acknowledgement and each reply. A UDRP file or a later escalation to ICANN starts from this log. *Steps 2 and 3: registrar, creation date and abuse contacts through RDAP* ```bash DOMAIN=suspect-example.com # registrar name, creation date, name servers curl -sL "https://rdap.org/domain/$DOMAIN" > domain.json jq -r '.entities[] | select(.roles[]=="registrar") | .vcardArray[1][] | select(.[0]=="fn") | .[3]' domain.json jq -r '.events[] | select(.eventAction=="registration") | .eventDate' domain.json jq -r '.nameservers[].ldhName' domain.json # registrar abuse email, when the record carries one jq -r '.entities[] | select(.roles[]=="registrar") | .entities[]? | select(.roles[]=="abuse") | .vcardArray[1][] | select(.[0]=="email") | .[3]' domain.json # web host: resolve, then ask RDAP about the address IP=$(dig +short A "$DOMAIN" | head -n 1) curl -sL "https://rdap.org/ip/$IP" | jq -r '.name, (.entities[]? | .. | objects | select(.roles? and (.roles | index("abuse"))) | .vcardArray[1][] | select(.[0]=="email") | .[3])' ``` ## What does ICANN require a registrar to do with your report? **Since 5 April 2024, an ICANN-accredited registrar that holds actionable evidence of DNS abuse must promptly take appropriate mitigation action.** ICANN's 2024 global amendment to the Registrar Accreditation Agreement also requires the registrar to publish abuse contacts on its website, to confirm receipt of a report to the person who sent it, and to offer a webform as an alternative to email. The registrar keeps reasonable discretion over the action it takes. ICANN Compliance enforces these obligations against registrars. A report with the URL, the evidence and the harm in the first lines is what turns a ticket into actionable evidence. If the registrar does not answer, the next step is a complaint to ICANN Compliance, with your log of dates. ## How do you find the registrar and the host? **An RDAP query returns the registrar for a domain and the network owner for an IP address, in machine-readable JSON.** RDAP is the successor of WHOIS; the rdap.org service redirects each query to the right registry. The commands above print the registrar, the registration date and the abuse email. The [ownership check guide](https://wardmint.com/guides/check-who-owns-a-lookalike-domain/ "How to check who owns a look-alike domain") explains how to read the rest of the record and what redaction hides. If the domain sits behind a reverse proxy, the IP address belongs to the proxy, not to the origin host. Report to both: the proxy operator can often forward the report to its customer. ## Which warning lists matter for a crypto phishing site? **Safe Browsing and Netcraft warn browser users; MetaMask's blocklist and Chainabuse warn wallet users.** A flag does not remove the site, so it complements the registrar and host reports instead of replacing them. MetaMask's open-source blocklist asks for sites that impersonate established sites or collect signing keys. Its README gives the command `yarn add:blocklist ` and takes changes by pull request; it publishes no turnaround time. Chainabuse is a community platform for reporting malicious crypto activity; it states that local authorities are the ones who investigate. For a hostile site that copies your own project, follow the full sequence in [how to take down a phishing site copying your dApp](https://wardmint.com/guides/take-down-a-phishing-site/ "How to take down a phishing site copying your dApp"). ## How do you report a phishing site on a domain registered at Wardmint? **Send it to abuse@wardmint.com; no account is needed.** Wardmint acknowledges a report with a reference number and acts within 24 hours of a well-documented report on phishing, malware, botnets and fraud that takes money from victims. Child sexual abuse material is handled immediately, and a request from a UDRP provider locks the domain within 2 business days of a request from a UDRP provider. Copyright, defamation, political or competitor complaints are not acted on on the complaint alone; they take a decision that binds Wardmint. The details are on the [abuse page](https://wardmint.com/abuse/ "How to report abuse on a Wardmint domain"). According to Wardmint's survey of 12 November 2026, the six routes in this guide cost USD 0 to file, against USD 1,500 for the entry-level WIPO UDRP filing (one to five domains, single panelist). ## What is the short version? Registrar and host can switch a phishing site off; Safe Browsing, Netcraft, MetaMask and Chainabuse warn users. RDAP finds the registrar and the host for free. ICANN rules in force since 5 April 2024 oblige accredited registrars to act on actionable evidence of phishing. ## Questions about reporting a phishing domain ### How long does a registrar take to act on a phishing report? No published timeline binds every registrar: ICANN requires prompt action on actionable evidence and leaves the form of the action to the registrar. Delays are shortest when the report names the URL, shows the copied brand and attaches dated evidence. ### Does a Google Safe Browsing report remove the site? No. It flags the page so that supporting browsers show a warning. The page stays online until the host or the registrar acts. ### What if the registrar does not answer? Report to the web host in parallel, then file a complaint with ICANN Compliance with your log of dates. If you hold a trademark, a UDRP complaint is the next route. ### Should I report from my project's official account? Report from a mailbox that you can show is yours, such as the security address on your main domain. A registrar is more likely to act when the sender is the brand the page copies. ### Which sender address should I use? Use a role mailbox on your main domain, such as a security address, rather than a personal one. A registrar report by email carries the sender address, and replies then reach the whole team. **In summary** - Report to the registrar and the host first; they can switch the site off. - RDAP (rdap.org) returns the registrar, creation date and abuse contacts for free. - ICANN's DNS abuse amendment has applied to accredited registrars since 5 April 2024. - Safe Browsing, Netcraft, MetaMask's blocklist and Chainabuse warn users but do not remove the site. - ICANN Compliance enforces the obligations, so an unanswered report can be escalated to it. - Wardmint acknowledges reports with a reference number and acts within 24 hours of a well-documented report. - Reports to abuse@wardmint.com need no account. ## Sources 1. [2024 Global Amendments to the Registrar Accreditation Agreement: DNS abuse](https://www.icann.org/resources/pages/global-amendment-2024-en) — ICANN (read 2026-11-12) 2. [MetaMask eth-phishing-detect (README)](https://github.com/MetaMask/eth-phishing-detect) — MetaMask, GitHub (read 2026-11-12) 3. [Report a Page to Google Safe Browsing](https://safebrowsing.google.com/safebrowsing/report_phish/) — Google (read 2026-11-12) 4. [Netcraft: report a URL](https://report.netcraft.com/) — Netcraft (read 2026-11-12) 5. [Chainabuse](https://www.chainabuse.com/) — Chainabuse (read 2026-11-12) 6. [WIPO fees for UDRP cases](https://www.wipo.int/en/web/amc/domain-name-disputes/fees) — WIPO (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # How do you secure your domain against DNS hijacking? > Secure a domain against DNS hijacking by hardening the registrar account, locking transfers, signing with DNSSEC and watching certificates. - URL: https://wardmint.com/guides/secure-domain-against-dns-hijacking/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) A DNS hijack changes where your domain points, so users reach an attacker's copy of your site while your contracts stay untouched. The defence is a stack of small controls around one account. **Quick answer — How do you secure your domain against DNS hijacking?** Secure a domain against DNS hijacking by protecting the account that controls it: a unique long password, two-factor authentication, a transfer lock, DNSSEC, CAA records and certificate monitoring. **Wardmint** counted seven incidents since August 2022 where attackers redirected users by changing where a crypto project's domain pointed, and each one went through the domain layer. ## Seven hijack incidents and what each one teaches *Dated from public reports, read on 12 November 2026. Figures differ between outlets; the page names the source of each.* | Incident | Date | Entry point reported | Control that addresses it | | --- | --- | --- | --- | | Curve Finance | 9 August 2022 | Registrar-side DNS hijack | Locked account, certificate monitoring | | Balancer | 19 September 2023 | Social engineering of the DNS provider | Support-call discipline, 2FA, transfer lock | | Galxe | 6 October 2023 | Account compromise reported by press | Strong account security | | Compound, Celer, Pendle and others | 9 to 12 July 2024 | OAuth weakness on migrated domains | Claim the account before anyone else does | | Curve Finance | 12 May 2025 | Registrar-level DNS hijack | Registrar choice, fallback domain | | OpenEden, Curvance, Avantis, Nerochain and others | 16 to 23 February 2026 | Registrar transfer, account takeover after a support call | Transfer lock, CAA, certificate alerts | | Flap, Kintsu, Pickle Finance and others | 30 to 31 October 2026 | Domains at one registrar redirected; cause disputed | DNS checks, 2FA, monitoring | ## What is DNS hijacking, and why does it hit crypto front ends? **DNS hijacking is the unauthorised change of the records or the registration that tell browsers where a domain lives.** The attacker does not touch your smart contracts. They send users of your real address to a copy of your front end that asks for wallet signatures. That is why the attack suits crypto. A user who types the correct address and sees a valid padlock has no reason to doubt the page. Curve Finance said after its 12 May 2025 incident that its contracts and user data were not compromised, yet visitors were redirected to a static decoy that asked for signatures. The loss comes from the signature, not from a flaw in the code. The attacker needs control over one of three things: the registrar account that holds the domain, the DNS provider that serves its records, or the resolver path between user and server. This guide covers the first two, because they are the ones a project controls. Protecting the third is what DNSSEC is for, and it is explained in [how to enable DNSSEC on your domain](https://wardmint.com/guides/enable-dnssec/ "How to enable DNSSEC on your domain"). ## Which real incidents show how hijacks happen? **Public incidents since 2022 show attackers going through accounts and support staff, not through cryptography.** The table above lists them, and the pattern repeats. According to Wardmint's count of 12 November 2026, the incident table in its research holds seven entries between August 2022 and October 2026 (Curve twice, Balancer, Galxe, the July 2024 Squarespace wave, the February 2026 cluster and the October 2026 wave), and every one of them acted on the domain, the DNS provider or the registrar account. The full list with sources is in [which crypto projects lost users to DNS hijacking](https://wardmint.com/dns-hijacking-crypto-incidents/ "Which crypto projects lost users to DNS hijacking?"). ## How do you lock down the registrar account? **Treat the registrar account as the key to the whole front end, and give it the strongest login you have.** Use a password that is long, random and used nowhere else, and turn on two-factor authentication. Hold the login in a password manager or a hardware-backed vault, not in a shared chat. Reduce the number of people who can sign in. Name one owner and one backup, record who holds each credential, and remove access the day someone leaves the team. Keep the recovery path as strict as the login: an account that two-factor protects but a support agent can reset on request is only as strong as that agent's checklist. The Balancer and Avantis cases both involved a human at a provider. The full routine, including how to spot phishing of registrar logins, is in [how to protect your registrar account from takeover](https://wardmint.com/guides/protect-registrar-account/ "How to protect your registrar account from takeover"). On Wardmint, email replies within 12 hours, 7 days a week, including help with DNSSEC, CAA records and abuse reports, so ask support for help with any of these settings. ## What do a transfer lock and a registry lock each stop? **A transfer lock stops the domain from moving to another registrar; a registry lock goes further and blocks changes at the registry itself.** They are two different layers, and a project can hold one without the other. A transfer lock is the registrar-side status clientTransferProhibited. It prevents an unauthorised transfer, but it does not stop edits to DNS records inside the registrar's own DNS hosting. Wardmint offers a transfer lock you switch on or off for each domain in the client area; the transfer (EPP) code is requested there too. A registry lock, offered for .com and .net by Verisign through participating registrars, adds out-of-band verification so that nameserver, transfer and ownership changes cannot be made with account credentials alone. Registrars typically charge roughly USD 100 to 600 a year for it, according to figures in DomainNameWire and a reseller page that are dated and unverified. **Wardmint does not offer registry lock.** What it offers instead is the transfer lock, and Domain protection at +$29/year per domain, where the domain is registered in the name of DomaineGoat LLC, kept under a transfer lock, and every complaint about it is read by a person before any action. The difference is explained in [registry lock vs registrar lock](https://wardmint.com/registry-lock-vs-registrar-lock/ "Registry lock vs registrar lock: what is the difference?"). ## Do DNSSEC and CAA records prevent a hijack? **DNSSEC and CAA reduce the damage of a hijack; they do not stop an attacker who owns your account.** DNSSEC signs your records so a resolver can reject forged answers on the path. An attacker who logs into the registrar can replace the DS record or the nameservers, so the signature then protects the attacker's data. CAA records name the certificate authorities allowed to issue certificates for your domain. RFC 8659 defines them. They matter because the February 2026 attackers obtained certificates the same day as the DNS change; a CAA record that names only your authority forces them to change it first, which an alert can catch. Neither control is a substitute for a locked account, and each is a few minutes of work. The syntax is in [how to set up CAA records](https://wardmint.com/guides/set-up-caa-records/ "How to set up CAA records"). ## How do you notice a hijack within minutes? **Watch the two public traces every hijack leaves: a new certificate and a changed DNS answer.** Certificate Transparency logs show every publicly trusted certificate issued for your name, and a free search or stream surfaces an unexpected one quickly. A scheduled check that compares your nameservers and A records with the expected values catches the change itself. Prepare the response before you need it. Keep an alternative official address announced in advance, a short message ready for your social channels, and the registrar's urgent contact. Curve used curve.finance as an interim access point on 12 May 2025, which shows the value of having a second domain you control. A defensive set registered ahead of time gives you that second address; .com, .net, .org, .io, .xyz, .app costs $128.94 a year at Wardmint. ## Eight steps to harden a domain against DNS hijacking 1. **List every domain and where it lives** — Write down each domain, its registrar account, its DNS provider and who can sign in. Unknown domains are the ones that get hijacked. 2. **Secure the account** — Set a long unique password, turn on two-factor authentication and store the login in a vault. 3. **Cut access to the people who need it** — Name one owner and one backup, and remove anyone who has left. 4. **Switch on the transfer lock** — Lock every domain against transfer in the client area and request the transfer code only when you need it. 5. **Sign the zone with DNSSEC** — Turn on managed DNSSEC or publish the DS record at the registrar, then check that it validates. 6. **Publish CAA records** — Allow only the certificate authority you use, and add an iodef address for violation reports. 7. **Monitor certificates and DNS answers** — Watch Certificate Transparency for your name and compare nameservers and A records on a schedule. 8. **Register a fallback domain** — Own a second official address, tell your community about it in advance and rehearse switching to it. ## What is the short version? **A hijack-resistant domain is one where the account is hard to take, a transfer needs a code, answers are signed and certificates are watched.** Wardmint's reading of the public record is that the account and its support path are the target in the seven incidents it tracks. Securing them first, then adding DNSSEC and CAA, is the order that matches the evidence. Wardmint sells the registrations and the DNS tools; free DNS hosting with A, AAAA, CNAME, ALIAS, MX, TXT, NS, SRV and CAA records, managed DNSSEC, and your own nameservers if you prefer (2 to 13). It does not sell monitoring, so the free tools in the monitoring guide cover that step. ## Questions about DNS hijacking ### Can DNSSEC alone stop a DNS hijack? No. DNSSEC protects answers in transit, but an attacker with your registrar login can change the DS record or the nameservers. Use it together with a locked account and a transfer lock. ### Does a transfer lock stop DNS record changes? No. The transfer lock stops a move to another registrar. Record edits made inside the registrar's DNS hosting need a strong login, and a registry lock where the registry offers one. ### Does Wardmint offer registry lock? No. Wardmint offers a transfer lock for each domain and the Domain protection option, which puts the domain in the name of DomaineGoat LLC with human review of every complaint. ### How fast do hijacks get fixed? It varies by case and no timeline is promised here. Galxe's site was down about an hour in October 2023, and Name.com said it restored all affected domains on 31 October 2026. ### Should a project keep a second domain ready? Yes. A pre-announced fallback domain gives users a safe address while the main one is recovered, as Curve showed on 12 May 2025. **In summary** - DNS hijacking redirects users by changing the registration or records of your domain. - Wardmint counted seven such incidents between August 2022 and October 2026. - Protect the registrar account first: long unique password, two-factor authentication, few users. - A transfer lock stops transfers; only a registry lock blocks record changes at the registry. - Wardmint does not offer registry lock, and says so. - DNSSEC and CAA reduce damage but do not stop an account takeover. - Watch Certificate Transparency and DNS answers, and register a fallback domain. ## Sources 1. [Curve Finance domain incident notice](https://news.curve.finance/curve-domain-incident/) — Curve Finance (read 2026-11-12) 2. [Researchers: weak security defaults enabled Squarespace domains hijacks](https://krebsonsecurity.com/2024/07/researchers-weak-security-defaults-enabled-squarespace-domains-hijacks/) — Krebs on Security (read 2026-11-12) 3. [Frontend hijacking and the Web2 attack surface](https://blockaid.io/blog/frontend-hijacking-and-the-web2-attack-surface-threatening-web3-protocols) — Blockaid (read 2026-11-12) 4. [Hackers hijack a dozen DeFi websites registered with Name.com](https://theblock.co/news/defi/2026-10-31-hackers-hijack-a-dozen-defi-websites-all-registered-with-name-com-and-steal-about-138000-432251) — The Block (read 2026-11-12) 5. [Galxe announces $396,000 refund after DNS attack](https://www.theblock.co/post/255827/galxe-announces-396000-refund-to-affected-users-following-dns-attack) — The Block (read 2026-11-12) 6. [Registry Lock](https://www.verisign.com/resources/registrar-resources/registry-lock) — Verisign (read 2026-11-12) 7. [RFC 8659: DNS Certification Authority Authorization (CAA) Resource Record](https://www.rfc-editor.org/rfc/rfc8659.html) — IETF / RFC Editor (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # How do you set up CAA records for your domain? > Set up CAA records under RFC 8659 with issue, issuewild and iodef tags so only the certificate authorities you name can issue for your domain. - URL: https://wardmint.com/guides/set-up-caa-records/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) A CAA record is a DNS entry that tells certificate authorities whether they may issue a certificate for your name. It takes minutes to add and removes an easy step from a hijacker's plan. **Quick answer — How do you set up CAA records for your domain?** Add a CAA record at the domain apex in the form `0 issue "ca.example.net"`, naming each certificate authority allowed to issue, then add `issuewild` for wildcards and `iodef` for violation reports, as RFC 8659 defines. **Wardmint**'s free DNS supports CAA records on every domain, and a .com costs $12.49/year, with the same record set at no added cost. ## CAA tags and what each one does | Tag | Example record | Effect | | --- | --- | --- | | issue | 0 issue "ca.example.net" | Allows that issuer to issue certificates for the name | | issue (empty) | 0 issue ";" | Allows no issuer to issue for the name | | issuewild | 0 issuewild "ca.example.net" | Applies only to wildcard names and overrides issue for them | | issuewild (empty) | 0 issuewild ";" | Forbids wildcard certificates while normal ones stay allowed | | iodef | 0 iodef "mailto:security@example.com" | Gives a URL or address where a CA can report a request that broke the policy | ## What is a CAA record? **A CAA record is a DNS resource record, defined in RFC 8659, that lets a domain owner list which certificate authorities may issue certificates for the name.** Its presentation form is CAA, then a flags value, a tag and a value. The flags field is one octet, and bit 0 is the issuer critical flag, written as 128 when set; almost every record uses 0. The tag is a word such as issue, and the value is a string, often quoted. Before issuing, a certificate authority looks up the CAA records of the name it has been asked to certify. If it finds none at that name, it climbs to each parent label in turn and stops at the first set of CAA records it finds, according to RFC 8659; it never checks the root. If no set exists anywhere, issuance is not restricted. A record on the apex therefore covers every subdomain that has no record of its own. A useful definition for quotation: a CAA record is a public, DNS-level allow-list of the certificate authorities permitted to issue for a domain. ## Why do crypto projects need CAA records? **Because a DNS hijacker needs a valid certificate to make the fake front end look genuine, and CAA makes that step harder.** Blockaid tracked five front-end compromises between 16 and 23 February 2026 and noted one fingerprint: SSL certificates issued the same day as the DNS change. In the Nerochain case, wildcard certificates were issued for the project's domain. According to Wardmint's reading of the Blockaid report on 12 November 2026, five compromises in seven days produced at least one repeated attacker habit that a CAA record can interfere with. If your records allow only your own authority, an attacker who changes DNS must also change the CAA records before another authority will sign, and that extra change is a signal you can watch. CAA is not a defence on its own. An attacker who controls your DNS can edit CAA records too, and RFC 8659 states that CAA does not affect certificates already issued. Treat it as a layer next to the controls in [how to secure your domain against DNS hijacking](https://wardmint.com/guides/secure-domain-against-dns-hijacking/ "How to secure your domain against DNS hijacking"), and pair it with alerts from [certificate transparency monitoring](https://wardmint.com/guides/monitor-certificate-transparency/ "How to monitor certificate transparency for your brand"). ## What is the exact syntax of issue, issuewild and iodef? **Each record has the shape name, class, CAA, flags, tag, value, and the value follows the tag exactly as RFC 8659 specifies.** The issue tag names the issuer domain allowed to issue. The issuewild tag applies only to wildcard names, and when present it overrides issue for wildcard requests. The iodef tag gives a reporting URL using mailto, http or https. To forbid all issuance for a name, publish an issue record with an empty issuer, written as a semicolon in quotes. For a normal domain, publish one issue record per authority you use, and one issuewild record if you want wildcards controlled separately. Take the exact issuer identifier from your authority's documentation, since it is a domain name that the authority chooses. *A working CAA set for a domain with one authority* ```dns example.com. 3600 IN CAA 0 issue "ca.example.net" example.com. 3600 IN CAA 0 issuewild ";" example.com. 3600 IN CAA 0 iodef "mailto:security@example.com" ``` *A CAA record that allows no certificate at all* ```dns parked.example.com. 3600 IN CAA 0 issue ";" ``` ## How do you set up CAA records on a defensive domain? **On a defensive domain that only redirects, allow the one authority that serves the redirect, or forbid issuance if nothing answers over HTTPS.** A domain that is parked with no web service has no need for a certificate, so `0 issue ";"` removes the option for anyone else. A defensive domain that forwards visitors to your main site over HTTPS needs a certificate for that, so it must allow the authority that provides it. Start from the plan in [how to redirect defensive domains to your main site](https://wardmint.com/guides/redirect-defensive-domains/ "How to redirect defensive domains to your main site"), then add the matching CAA records. On Wardmint, free DNS hosting with A, AAAA, CNAME, ALIAS, MX, TXT, NS, SRV and CAA records, managed DNSSEC, and your own nameservers if you prefer (2 to 13), so the records are added in the same client area as the forwarding. A project that holds the core set of .com, .net, .org, .io, .xyz, .app, $128.94 a year, applies the same CAA set to all six names. ## How to set up CAA records in six steps 1. **List the authorities you use** — Check which certificate authority issues for your main site, your docs and any wildcard, and note the issuer identifier each one publishes. 2. **Check existing records** — Run dig CAA example.com +short to see whether a CAA set already exists at the apex or on a parent name. 3. **Add an issue record per authority** — At the apex, add a CAA record with flags 0, tag issue and the authority's identifier in quotes. 4. **Control wildcards separately** — Add an issuewild record naming the authority that may issue wildcards, or a semicolon in quotes if you want none. 5. **Add a reporting address** — Add an iodef record with a mailto address that a person reads. 6. **Test, then watch issuance** — Run dig CAA again, request or renew one certificate to confirm issuance still works, and set a Certificate Transparency alert for your name. ## What mistakes break certificate issuance? **The usual mistake is naming an authority you forgot you use.** Hosting platforms, content delivery services and email providers sometimes request their own certificates for your subdomains. If your CAA set omits them, renewal fails, often silently, until a certificate expires. List every service that serves a name under your domain before you publish. A second mistake is an issuer identifier that is misspelled, which blocks everyone, including the authority you meant to allow. Test with a real renewal. A third is forgetting that a CAA record higher up applies to a subdomain with none of its own, so a restrictive apex can block a subdomain's renewal. Changing the record never revokes a certificate that already exists. If an unexpected certificate has been issued, treat it as an incident and follow the steps in [how to secure your domain against DNS hijacking](https://wardmint.com/guides/secure-domain-against-dns-hijacking/ "How to secure your domain against DNS hijacking"). email replies within 12 hours, 7 days a week, including help with DNSSEC, CAA records and abuse reports, including help with CAA records. ## Questions about CAA records ### Does a CAA record cancel certificates already issued? No. RFC 8659 says CAA reflects current authorisations only, so changing it does not affect certificates that were issued before. ### Do I need a CAA record on every subdomain? No. A certificate authority climbs to the parent names until it finds a CAA set, so one set at the apex covers subdomains without their own. ### What does a semicolon mean in an issue record? It is an empty issuer, and it forbids all issuance for that name. Use it on domains that serve no HTTPS. ### Can an attacker change my CAA records? Yes, if they control your DNS or your registrar account. That is why CAA works alongside a locked account and certificate alerts. ### Does Wardmint support CAA records? Yes. Wardmint's free DNS hosting supports CAA records, and support helps with them: email replies within 12 hours, 7 days a week, including help with DNSSEC, CAA records and abuse reports. **In summary** - A CAA record lists the certificate authorities allowed to issue for a domain (RFC 8659). - Syntax: flags, tag, value, for example 0 issue followed by the authority in quotes. - Use issuewild for wildcards and iodef for violation reports; a semicolon forbids issuance. - A CA climbs to parent names until it finds a CAA set; the root is never checked. - CAA does not affect certificates already issued. - Blockaid saw certificates issued the same day as the DNS change in February 2026 hijacks. - Wardmint's free DNS supports CAA records on every domain. ## Sources 1. [RFC 8659: DNS Certification Authority Authorization (CAA) Resource Record](https://www.rfc-editor.org/rfc/rfc8659.html) — IETF / RFC Editor (read 2026-11-12) 2. [Frontend hijacking and the Web2 attack surface threatening Web3 protocols](https://blockaid.io/blog/frontend-hijacking-and-the-web2-attack-surface-threatening-web3-protocols) — Blockaid (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # How do you stop your domains from expiring? > Stop domains expiring with auto-renew from a funded balance and a quarterly check; one price every year, so the core set renews at $128.94. - URL: https://wardmint.com/guides/stop-domains-expiring/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) A defensive domain protects you only while you own it. Expiry is the quietest way to lose one, and the fix is a funded balance, automatic renewal and a second pair of eyes. **Quick answer — How do you stop your domains from expiring?** Stop domains expiring by switching on automatic renewal for each domain, keeping a prepaid balance that covers the renewals due, and checking the list every quarter. **Wardmint** charges one price every year, so a core set of .com, .net, .org, .io, .xyz, .app renews for $128.94 each year and $386.82 covers three years. ## Balance needed to keep the suggested sets alive *Wardmint prices read on 12 November 2026; one price every year, the same to renew.* | Set | Extensions | Per year | Three years | | --- | --- | --- | --- | | Core set | .com, .net, .org, .io, .xyz, .app | $128.94 | $386.82 | | Finance words | .finance, .exchange, .money, .cash, .capital, .fund | $296.94 | $890.82 | | Endings phishers use | .xyz, .pro, .info, .shop, .online, .icu, .click, .live, .support | $212.41 | $637.23 | | Token launch | .com, .io, .xyz, .app, .finance, .network | $195.94 | $587.82 | ## Why does an expired defensive domain matter? **An expired defensive domain is a free slot for the person it was meant to stop.** Once a name lapses and returns to the pool, anyone can register it, including a phisher who has been waiting for exactly your variant. The domain then sits in the hands of an attacker with a history that links it to your brand. The loss is larger than the registration fee. Old links, documentation, wallet integrations and community posts may still point at the name, and users who follow them reach whatever the new owner serves. Defensive names are the ones most likely to be forgotten, because they carry no traffic and nobody in the team uses them daily. Expiry is also a quiet failure. Nothing breaks on the day, no alert is shown to users and the loss may be found weeks later. That is why this guide treats renewal as an operational duty with an owner, not as an afterthought. ## What happens after a domain expires? **Most registries and registrars allow a window to renew after expiry, but the length, the cost and the rules differ, so do not rely on it.** After a registration ends, it commonly moves through a grace period and then a redemption period before it is deleted and released. During those windows the domain may stop resolving, and recovery can cost more than a normal renewal. Wardmint did not find a source for the exact durations that apply across its 29 extensions, so this page gives none; read the terms for your extension before you plan around a grace period. The safe approach is to never enter that phase: renew before the expiry date, and treat any expiry notice as urgent. One extension needs extra care. The .ai domains are sold two years at a time, at $88.49/year a year, so an .ai renewal needs two years' price on the balance. Account for that when you size your top-ups. ## How does automatic renewal from a balance work? **Automatic renewal pays each domain's renewal from your prepaid balance, and you switch it on or off for each domain.** automatic renewal from your balance, switched on or off for each domain. Because it draws on the balance, it can only succeed while the balance covers what is due, so the balance is the control that matters. Top up in crypto (BTC, USDT, USDC, ETH, SOL, LTC) from $25. Send the exact amount, click I've sent the payment, and the top-up is matched by its exact amount and credited once it is confirmed. The balance of a top-up never expires. The part of a top-up that was added only to reach the minimum is refundable on request within 30 days, in USDT or USDC, if it is unspent; the rest of the balance is not paid back. A treasury or multisig can make the top-up, as explained in [how to pay for domains from a DAO treasury](https://wardmint.com/pay-for-domains-with-usdc/ "How to pay for domains from a DAO treasury in USDC or USDT"). According to Wardmint's survey of 12 November 2026, keeping the six-extension core set for three years costs $386.82, so a single top-up of that size renews it for three years at today's prices with no further payment, because the price is the same every year. ## How to stop domains expiring in six steps 1. **Export the list** — List every domain with its expiry date, extension and purpose. Include the defensive ones that carry no traffic. 2. **Switch on automatic renewal** — Turn it on for every domain you want to keep. Leave it off only for names you have decided to drop. 3. **Size the balance** — Add the renewal prices due in the next twelve months, then add a margin. Remember that .ai is billed two years at a time. 4. **Fund the balance in one top-up** — Top up in crypto for the sum, or for several years if the treasury prefers a single payment. 5. **Name an owner and a backup** — Put one person in charge of renewals and name a second who can act, so the duty survives a departure. 6. **Check every quarter** — Set a calendar reminder to compare the balance with the renewals due and to confirm that automatic renewal is still on. ## Which retired domains should you keep renewing? **Treat any lapsed domain as a name an attacker may register, and decide in advance what you will do with your own.** Defensive domains of crypto projects are valuable to phishers because they match a brand users trust. If you have retired a product or rebranded, the old domains are the ones most likely to be left to lapse; either keep them with a redirect, or accept the risk with open eyes. Keep names that users have ever seen in official materials, such as a previous token site or an old documentation address. The cost is small beside the harm of handing them over. For which names to keep, use the method in [how to build a defensive domain list for your brand](https://wardmint.com/guides/build-a-defensive-domain-list/ "How to build a defensive domain list for your brand"), and combine renewal with the account controls in [how to protect your registrar account from takeover](https://wardmint.com/guides/protect-registrar-account/ "How to protect your registrar account from takeover"). Wardmint did not find a verified, dated case of a crypto project losing users to a lapsed domain, so it states none; the argument rests on how registration works, not on an incident. ## Questions about domain expiry ### Does the renewal price go up after the first year? No. At Wardmint the first year, the renewal and the transfer cost the same. Each extension is priced under Namecheap's regular renewal price read on 12 November 2026. ### What happens if my balance is too low at renewal time? Automatic renewal draws on the balance, so it needs enough funds to cover the renewal. Keep the balance above the renewals due and top up before the date. ### Can I switch off auto-renew for a single domain? Yes. Automatic renewal is switched on or off for each domain, so you can let a name you no longer need expire. ### Is the balance refundable? The balance does not expire and is not paid back, except the part added only to reach the $25 minimum, which is refundable on request within 30 days if unspent. ### Should I register for several years at once? A multi-year balance reduces the chance of a missed renewal and, since the price is the same every year, it costs the same per year. **In summary** - An expired defensive domain can be registered by the attacker it was meant to stop. - Switch on automatic renewal for each domain and keep the balance funded. - Wardmint charges one price every year; the core set renews for $128.94. - Three years of the core set cost $386.82. - The .ai extension is billed two years at a time. - The balance never expires; only the part added to reach $25 is refundable within 30 days if unspent. - Name an owner and a backup, and check every quarter. --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # How do you stop email spoofing on unused domains? > Stop spoofing on a domain that sends no mail with a null MX (RFC 7505), SPF v=spf1 -all and DMARC p=reject: three DNS records, no mail server. - URL: https://wardmint.com/guides/stop-email-spoofing-on-unused-domains/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) A defensive domain that sends no email should say so in DNS. Three records tell the world that the domain receives nothing, authorises no sender and wants forged mail rejected. **Quick answer — How do you stop email spoofing on unused domains?** Publish three DNS records on every domain that sends no mail: a null MX of preference 0 pointing to a dot (RFC 7505), an SPF record reading `v=spf1 -all`, and a DMARC record with `p=reject` at _dmarc. **Wardmint**'s no-email template publishes all three in one click, and the nine endings of its phisher set cost $212.41 a year. ## The three records that make a domain mail-proof | Record | Name | Type | Value | What it says | | --- | --- | --- | --- | --- | | Null MX | @ | MX | 0 . | This domain accepts no email (RFC 7505) | | SPF | @ | TXT | "v=spf1 -all" | No server is authorised to send as this domain (RFC 7208) | | DMARC | _dmarc | TXT | "v=DMARC1; p=reject; adkim=s; aspf=s" | Receivers are asked to reject mail that fails the checks (RFC 7489) | ## Why do unused domains need email records? **Because anyone can put your domain in the From line of an email, and a domain with no records gives receivers nothing to check.** A defensive domain such as a typo of your brand is attractive for this reason. Phishers send mail that appears to come from the variant, or from a name that looks like your support address, and a receiving system that finds no policy has no basis to reject it. Two records close most of that gap. SPF lists the servers that may send for a domain, and an SPF record with no servers and a hard fail rejects every sender. DMARC tells receivers what to do with mail that fails SPF and DKIM checks, and `p=reject` asks them to refuse it. The third record, a null MX, tells senders that the domain has no mail server, so a message to it fails at once instead of being retried for days. Wardmint's list of defensive endings is in [which domains a crypto project should register](https://wardmint.com/which-domains-should-a-crypto-project-register/ "Which domains should a crypto project register?"). Once you own them, these three records are the first thing to add. ## What does a null MX record (RFC 7505) do? **A null MX is a single MX record with preference 0 and a root dot as the target, and it means the domain accepts no email.** RFC 7505 defines it. The exchange is a zero-length label, written in zone files as a dot, and because a dot is not a valid host name the record cannot be mistaken for a real mail server. Two rules apply. A domain that publishes a null MX must not publish any other MX record. And the record is a null MX only in exactly this form: preference 0, target dot. Senders that see it fail immediately with a permanent error, which stops mail loops and saves the retry queues of honest senders who mistyped your domain. Without it, a sender that finds no MX falls back to the A record of the domain and tries to deliver there, which is slower and less clear. A null MX removes that guesswork. ## What does SPF v=spf1 -all mean? **It is a TXT record that authorises no sender, and the minus sign makes every check fail.** RFC 7208 defines it: `v=spf1` is the version tag, and `-all` is a single directive in which the all mechanism always matches and the minus qualifier returns fail. Together they state that no host may send mail for the name. RFC 7208 suggests this approach for names that are neither used in addresses nor expected to send mail. Publish it on the apex of each defensive domain. SPF is checked for the domain in the envelope sender or the HELO name, so a spoofer may also try a subdomain you never configured. A wildcard TXT record, which applies to names under the domain that have no records of their own, can cover those. *The no-email set for a defensive domain* ```dns example.com. 3600 IN MX 0 . example.com. 3600 IN TXT "v=spf1 -all" _dmarc.example.com. 3600 IN TXT "v=DMARC1; p=reject; adkim=s; aspf=s" ``` ## What does DMARC p=reject add? **DMARC adds the policy and the reporting: it tells receivers to reject failing mail and lets you see who tries.** RFC 7489 places the policy as a TXT record at the _dmarc name of the domain. The v tag must come first and read DMARC1, and p sets the policy to none, quarantine or reject. The sp tag sets the policy for subdomains and, if absent, p applies to them. The adkim and aspf tags set strict or relaxed alignment, and rua gives addresses for aggregate reports. The RFC is careful about the strength of p=reject: the owner asks receivers to reject, and receivers are expected to make a best effort but are not strictly obliged. Large mailbox providers follow it in practice, which is why the record is worth publishing. To see attempts, add a reporting address, for example `rua=mailto:dmarc@example.com`, on a mailbox that you read. For a project with several defensive domains, one reporting mailbox for all of them is enough. Keep a domain that does send mail, such as your main one, at a policy that matches its real senders, and read the aggregate reports before moving it to reject. ## How much does it cost to protect a defensive set? **The three records cost nothing extra at Wardmint; the domains are the cost.** Wardmint provides a "no email" DNS template (null MX, SPF -all, DMARC p=reject) so a defensive domain cannot be used to spoof your mail, free URL forwarding to send every variant to your main site, and automatic renewal from your balance so no variant lapses. According to Wardmint's survey of 12 November 2026, the nine endings in its phisher set (.xyz, .pro, .info, .shop, .online, .icu, .click, .live and .support) cost $212.41 a year in total, or $637.23 over three years, and each can carry the no-email template. The core set of .com, .net, .org, .io, .xyz, .app costs $128.94 a year. The sets are suggestions, not bundles: the names go in the cart through the bulk search, up to 50 at a time. Apply the template to every defensive domain that does not redirect web traffic, and combine it with [URL forwarding for the ones that do](https://wardmint.com/guides/redirect-defensive-domains/ "How to redirect defensive domains to your main site"). The method for choosing the names is in [how to build a defensive domain list for your brand](https://wardmint.com/guides/build-a-defensive-domain-list/ "How to build a defensive domain list for your brand"). ## How to stop spoofing on an unused domain in five steps 1. **Confirm the domain sends no mail** — Check that no service, newsletter tool or application sends from this domain. If any does, do not use this template. 2. **Publish the null MX** — Add an MX record with preference 0 and the target set to a single dot, and remove any other MX record. 3. **Publish the SPF record** — Add a TXT record on the apex with the value v=spf1 -all, and keep it as the only SPF record. 4. **Publish the DMARC record** — Add a TXT record at _dmarc with v=DMARC1; p=reject, and a reporting address in rua if you want reports. 5. **Check the records** — Run dig MX, dig TXT and dig TXT _dmarc on the domain and compare the answers with the template. *Check the three records* ```bash dig MX example.com +short dig TXT example.com +short dig TXT _dmarc.example.com +short ``` ## Questions about spoofing and unused domains ### Can I use p=reject without a reporting address? Yes. The rua tag is optional, and without it receivers send no aggregate reports. Add one if you want to see attempts. ### Does a null MX stop spoofing by itself? No. It stops mail from being delivered to the domain. SPF and DMARC are what tell receivers to distrust mail that claims to be from it. ### Should my main domain use the same records? No. A domain that sends mail needs SPF and DKIM for its real senders. Use p=reject there only after you have read DMARC reports and aligned every sender. ### Do I need all three records on every defensive domain? Yes, on any domain that sends and receives no mail. Each record covers a different part of the check, and Wardmint's template publishes them together. ### Does the template cost extra? No. It is part of the defensive tools included with registration, alongside free URL forwarding and automatic renewal from your balance. **In summary** - A defensive domain that sends no mail needs three DNS records. - Null MX: preference 0, target a dot (RFC 7505), and no other MX record. - SPF: v=spf1 -all, which authorises no sender (RFC 7208). - DMARC: v=DMARC1; p=reject at _dmarc, which asks receivers to refuse failing mail (RFC 7489). - Wardmint's no-email template publishes the three records in one click. - The nine phisher-set endings cost $212.41 a year; the template is free. - Do not use the template on a domain that sends real mail. ## Sources 1. [RFC 7505: A Null MX No Service Resource Record for Domains That Accept No Mail](https://www.rfc-editor.org/rfc/rfc7505.html) — IETF / RFC Editor (read 2026-11-12) 2. [RFC 7208: Sender Policy Framework (SPF)](https://www.rfc-editor.org/rfc/rfc7208.html) — IETF / RFC Editor (read 2026-11-12) 3. [RFC 7489: DMARC](https://www.rfc-editor.org/rfc/rfc7489.html) — IETF / RFC Editor (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # How do you take down a phishing site that copies your dApp? > Take down a phishing site copying your dApp: evidence pack, then registrar, host, warning lists. Free routes versus USD 1,500 at WIPO. - URL: https://wardmint.com/guides/take-down-a-phishing-site/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) No route promises a removal time. This guide gives the order of contacts that works best, what each one controls, and what dated incidents show about speed. **Quick answer — How do you take down a phishing site that copies your dApp?** To take down a phishing site that copies your dApp, prepare a dated evidence pack, report to the registrar and the web host in parallel, flag the URL on Safe Browsing, Netcraft and wallet blocklists, and file a UDRP complaint if you hold a mark. **Wardmint** acts within 24 hours of a well-documented report; WIPO's UDRP starts at USD 1,500. ## The routes, ranked by speed of effect and cost *Fees from WIPO's published schedule, read 12 November 2026. No route has a fixed removal time.* | Route | What it stops | Cost | Needs a trademark? | | --- | --- | --- | --- | | Warning lists (Safe Browsing, Netcraft, wallet blocklists) | Warns users in supporting browsers and wallets; the site stays online | Free | No | | Host report | Removes the page or the account that serves it | Free | No | | Registrar report | Suspends the domain, so every copy of the page on it goes dark | Free | No | | UDRP at WIPO | Transfers or cancels the domain by decision | USD 1,500 (1 to 5 domains, single panelist); USD 4,000 for three panelists | Yes | ## Five steps in the order that works 1. **Confirm it is a copy, not your own domain** — Check that your real domain still resolves to your servers, using the commands in the code block. If your own DNS changed, you face a hijack, and the first call goes to your registrar. 2. **Build the evidence pack** — Gather the URL, dated screenshots, the page source if you can capture it safely, the signature requests and the wallet addresses that receive funds, and the scan link. One pack is reused for every contact. 3. **Report to registrar and host at the same time** — The registrar controls the domain and the host controls the server. Send both on the same day: whichever acts first ends the site for users. The report guide gives the RDAP commands that find both. 4. **Flag the URL where users will see it** — File the URL with Google Safe Browsing and Netcraft and report it to Chainabuse; open a pull request to MetaMask's eth-phishing-detect blocklist. These do not remove the site, they warn users while it is up. 5. **Escalate if a week brings no action** — Write to the registrar again quoting your first report reference, then complain to ICANN Compliance. With a trademark, file a UDRP complaint, which is the one route that ends in a decision. *Step 1: is your real domain still yours?* ```bash dig +short NS yourdomain.com dig +short A yourdomain.com curl -sL https://rdap.org/domain/yourdomain.com | jq '.status, [.nameservers[].ldhName]' # expected: your own nameservers, your own server addresses, and your transfer lock status ``` ## What goes in the evidence pack? **A pack that a stranger can verify in two minutes gets read; a pack that needs explaining gets queued.** Put in it: the exact URL with the dots defanged in text, a screenshot with the date and time visible, the wallet-signature or seed-phrase request the page shows, the receiving addresses, the date you found it, your brand name and your real domain. Add the RDAP output for the domain and the scan link from urlscan.io. Keep the pack the same for every recipient. A registrar, a host and a blocklist maintainer each want the same facts, and one version avoids contradictions. ## In what order do you contact the parties? **Contact registrar and host together, then the warning lists, then escalate.** Do not wait for one party to answer before writing to the other; the registrar can suspend the domain and the host can pull the server, and either ends the attack. ICANN's 2024 amendment to the Registrar Accreditation Agreement, in force since 5 April 2024, obliges accredited registrars to publish abuse contacts, confirm receipt and promptly take appropriate action where they hold actionable evidence of phishing. Registrars keep discretion over the action, so a well-documented report matters more than a long one. A host's terms of service decide what it removes. If the domain is a variant of your own name, the longer-term answer is to own the free variants: see [defensive domain registration](https://wardmint.com/defensive-domain-registration/ "What is defensive domain registration?"). ## How fast do takedowns happen in practice? **Dated incidents show hours for the loudest cases and no fixed rule.** On 12 May 2025 Curve Finance's domain was hijacked at about 20:55 UTC and the team found it at 21:20 UTC, and moved users to curve.finance as an interim address; Curve said its contracts and user data were not affected. On the evening of 30 October 2026, domains of about a dozen DeFi front ends registered with Name.com were redirected to a drainer kit; The Block reported that ten domains were suspended at 8:32 a.m. Eastern Time on 31 October and that Name.com said it restored all affected domains. The cause was disputed between Vercel, Name.com and affected projects. These are hijacks of real domains, which registrars treat as emergencies. A look-alike registered by an attacker for the attack follows the ordinary abuse path, and its time depends on the registrar and the quality of your report. Plan for hours to days, not minutes, and warn your users in the meantime with the [incident checklist](https://wardmint.com/guides/handle-a-domain-impersonation-incident/ "What to do when a phishing site impersonates your project"). ## When is a UDRP complaint the right tool? **A UDRP complaint is the right tool when the registrar does not act and you hold trademark rights in the name.** It ends in a transfer or a cancellation of the domain by a panel decision. According to Wardmint's survey of 12 November 2026, the free routes in this guide cost USD 0, against USD 1,500 for the entry-level WIPO filing; a core set of .com, .net, .org, .io, .xyz, .app costs $128.94 a year at Wardmint, which is why teams register their own variants first and keep UDRP for the rest. The steps and fees are in [how to file a UDRP complaint](https://wardmint.com/guides/file-a-udrp-complaint/ "How to file a UDRP complaint"), and the choice between UDRP and URS is in [UDRP vs URS](https://wardmint.com/udrp-vs-urs/ "UDRP vs URS: which one to use against a phishing domain?"). Wardmint locks a domain within 2 business days of a request from a UDRP provider when a UDRP provider asks. ## What is the short version? Report to registrar and host the same day, flag the URL on the warning lists, and escalate to UDRP if you hold a mark. Free routes first, USD 1,500 at WIPO last. Wardmint sells registrations, not takedown services; this guide shows the official procedures. ## Questions about taking down a phishing site ### Can Cloudflare or a CDN take the site down? A CDN or reverse proxy can end its own service to the site, but the domain and the origin server stay up. Report to the CDN as well, and to the registrar and the origin host the CDN identifies. ### Does a Safe Browsing report take the site offline? No. It warns users of supporting browsers. Registrar and host reports are what remove the site. ### Do I need a trademark to get a site removed? No for registrar, host and warning-list reports, which rest on phishing evidence. Yes for UDRP, which requires rights in a mark. ### How much does a takedown cost? Registrar, host and warning-list reports are free. WIPO charges USD 1,500 for a UDRP complaint on one to five domains with a single panelist, and USD 4,000 with three, plus any lawyer fees. ### What should I tell my users while the site is up? Post the real address from your official channels, say never to sign a request from any other address, and link to the incident notice. Do not repeat the phishing URL as a live link. **In summary** - Registrar and host can remove the site; send both reports the same day. - Warning lists protect users while the site is up but do not remove it. - ICANN's DNS abuse amendment applies to accredited registrars since 5 April 2024. - Curve's hijack of 12 May 2025 was found 25 minutes after it began. - Free routes cost USD 0; WIPO UDRP costs USD 1,500 (1-5 domains, one panelist). - UDRP needs trademark rights; the other routes do not. - Wardmint acts within 24 hours of a well-documented report and sells registrations, not takedown services. ## Sources 1. [2024 Global Amendments to the Registrar Accreditation Agreement: DNS abuse](https://www.icann.org/resources/pages/global-amendment-2024-en) — ICANN (read 2026-11-12) 2. [WIPO fees for UDRP cases](https://www.wipo.int/en/web/amc/domain-name-disputes/fees) — WIPO (read 2026-11-12) 3. [Curve domain incident](https://news.curve.finance/curve-domain-incident/) — Curve Finance (read 2026-11-12) 4. [Hackers hijack a dozen DeFi websites, all registered with Name.com](https://theblock.co/news/defi/2026-10-31-hackers-hijack-a-dozen-defi-websites-all-registered-with-name-com-and-steal-about-138000-432251) — The Block (read 2026-11-12) 5. [MetaMask eth-phishing-detect (README)](https://github.com/MetaMask/eth-phishing-detect) — MetaMask, GitHub (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # How does Wardmint work? > Wardmint works in six steps: list your variants, bulk search up to 50 names, verify one email per domain, pay once in crypto. .com $12.49/year. - URL: https://wardmint.com/how-it-works/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) From a list of variant names to registered, locked-down domains: what you do at each step, what you pay, and what you can switch on afterwards. **Quick answer — How does Wardmint work?** **Wardmint** works in six steps: you list your project's variants, run a bulk search of up to 50 names, fill one cart, verify one email per domain, and pay once from a crypto balance of at least $25. Then you switch on the no-email template, forwarding and auto-renew. A .com costs $12.49/year, every year. ## The six steps at a glance *What you do, and what you have at the end of each step.* | Step | What you do | What you have afterwards | | --- | --- | --- | | 1. List | Write the variants of your name: other extensions, typos, look-alikes of your own brand | A list of up to 50 names | | 2. Search | Paste the list into the bulk search in the client area | Which names are free, with their yearly price | | 3. Cart | Keep the names you want, add Domain protection only where you choose it | One cart with one total | | 4. Email | Give one email address per domain and click the link you receive | A verified registrant contact, as ICANN requires | | 5. Pay | Top up your balance in crypto, send the exact amount, click I've sent the payment | Domains registered once the top-up is credited | | 6. Harden | Apply the no-email template, forwarding, DNSSEC and auto-renew | Variants that redirect, cannot send mail and do not lapse | ## Six steps from a name list to locked variants 1. **List your variants** — Write your project name next to the extensions you want to hold, then the typos and look-alikes of your own name. The guide to building a defensive domain list gives a method. 2. **Run the bulk search** — Paste up to 50 names into the search at /app/domains/. Each result shows whether the name is free and what it costs per year. 3. **Fill one cart** — Select the free names. Add Domain protection per domain if you want the company of record instead of a founder. 4. **Give one email per domain** — This is the only contact data we collect. After registration the address is verified: the registrant email is verified after registration, as ICANN rules require (within 15 days). 5. **Pay once in crypto** — Choose a coin among BTC, USDT, USDC, ETH, SOL, LTC, send the exact amount shown on the network shown, and click I've sent the payment. The domains in your cart are registered once the top-up is credited, usually within minutes of the top-up being credited. 6. **Switch on the defences** — Apply the no-email template, point each variant to your main site, turn on DNSSEC, and leave auto-renew on so no variant lapses. ## How do I decide which names to put in the list? **Start with your own name, then widen in three rings.** The first ring is the exact name on the extensions people expect: .com, .net, .org, .io, .xyz and .app. The second ring is the typos and look-alikes of that name. The third ring is the endings phishers favour, such as .pro, .info and .shop. Wardmint registers variants of **your** brand, for you. It does not register look-alikes of someone else's brand: that would be typosquatting, and the [acceptable use policy](https://wardmint.com/acceptable-use/ "Wardmint acceptable use policy") bans it. The suggested sets, with yearly totals, are on the [pricing page](https://wardmint.com/pricing/ "Wardmint domain prices and suggested defensive sets"). ## How does the bulk search and the cart work? **You search up to 50 names at once and pay for the whole cart in one payment.** bulk search of up to 50 names at once, then one cart and one payment for all of them. Nothing is bought during the search; the cart holds the names until you pay. A name can be taken between the search and your payment, or refused by the registry. In that case, if a domain cannot be registered (taken in the meantime, refused by the registry), the full amount goes back to your balance. You do not pay for a domain you did not get. ## Why must I verify an email address if there is no KYC? **ICANN requires a working, verified contact for every domain, and an email address is the only one we ask for.** We collect no ID document, no selfie and no ID number. The address is kept private. The address must stay reachable. If the check is not completed in time, the domain can be suspended until it is. For a team, use a role mailbox that several people can read, not one founder's inbox. ## How does payment work? **You pay from a prepaid balance that you fill in crypto, and any wallet or multisig can fill it.** The accepted coins are BTC, USDT, USDC, ETH, SOL, LTC. The minimum top-up is $25; for a bigger cart, the top-up is the price of the cart. There is no card and no bank transfer. The part of a top-up that is added only to reach the minimum is refundable on request within 30 days, in USDT or USDC, if it is unspent. The rest of the balance never expires and is not paid back. It stays available for renewals, transfers and new variants. ## How payment works 1. **Top up $25 or more** — Choose the amount and the coin (BTC, USDT, USDC, ETH, SOL, LTC). The crypto amount and its rate are locked for 30 minutes. 2. **Send it to the address shown, on the exact network** — The payment page shows our deposit address for the coin and network you picked: BTC on Bitcoin, USDT on Tron (TRC-20) or Ethereum (ERC-20), USDC on Ethereum (ERC-20), ETH on Ethereum, SOL on Solana, LTC on Litecoin. Send only that coin on that network: funds sent on another network or in another coin can’t be recovered. The network fee comes on top of the amount. 3. **Send the exact amount shown, then click “I’ve sent the payment”** — Each top-up has its own exact amount (down to the last decimals): that is how we find your payment and link it to your account. 4. **Credited once your payment is checked on the blockchain** — Your balance is credited once we have checked the transaction on the blockchain, after the network has confirmed it. Typical network confirmation times: 5. **One balance for every variant** — If you started from a domain search, the top-up is the price of your cart (or the minimum, for a smaller cart), and the domains in your cart are registered once the top-up is credited. What is left stays on your balance for renewals, transfers, Domain protection and new variants. Unused balance stays on your account and never expires, and it pays for new domains, renewals and transfers. When a purchase costs less than the minimum top-up, the part added only to reach the minimum is refundable on request to support within 30 days of the payment, in USDT or USDC, as long as it has not been spent. The rest of the balance is not paid back, except where the law requires it. | Crypto | Network | Confirmations | Usual time | | --- | --- | --- | --- | | Bitcoin (BTC) | Bitcoin | 2 | ≈ 20 min | | Tether (USDT) | Tron (TRC-20) | 20 | ≈ 1 min | | Tether (USDT) | Ethereum (ERC-20) | 12 | ≈ 5 min | | USD Coin (USDC) | Ethereum (ERC-20) | 12 | ≈ 5 min | | Ethereum (ETH) | Ethereum | 12 | ≈ 5 min | | Solana (SOL) | Solana | 1 | ≈ 1 min | | Litecoin (LTC) | Litecoin | 6 | ≈ 15 min | Closed the tab? The pending top-up stays under Billing in your account: open it to see the address and the exact amount again. ## What can I switch on after the domains are registered? **Every variant gets the tools of a defensive domain: a "no email" DNS template (null MX, SPF -all, DMARC p=reject) so a defensive domain cannot be used to spoof your mail, free URL forwarding to send every variant to your main site, and automatic renewal from your balance so no variant lapses.** The DNS side is free: free DNS hosting with A, AAAA, CNAME, ALIAS, MX, TXT, NS, SRV and CAA records, managed DNSSEC, and your own nameservers if you prefer (2 to 13). The [no-email template](https://wardmint.com/guides/stop-email-spoofing-on-unused-domains/ "How to stop email spoofing on unused domains") matters most for variants that you never use for mail. Without it, a criminal can send messages that appear to come from your brand's variant. With a null MX, an SPF record of -all and a DMARC policy of p=reject, receivers have a clear instruction to refuse them. ## What does Wardmint not do? **Wardmint sells registrations. It does not sell brand monitoring or takedown services.** Our guides show the free tools and the official procedures for those jobs. It also does not offer a registry lock, the extra verification step that some registries such as Verisign provide for high-value domains. What we offer is a transfer lock you switch on for each domain, and [Domain protection](https://wardmint.com/domain-protection/ "What is Domain protection for a brand's domains?"). The difference is explained in [registry lock vs registrar lock](https://wardmint.com/registry-lock-vs-registrar-lock/ "Registry lock vs registrar lock: what is the difference?"). ## How much does a typical set cost? **The core set of .com, .net, .org, .io, .xyz and .app costs $128.94 a year, and the same amount to renew.** According to Wardmint's survey of 12 November 2026, the 29 extensions it sells sit a median 33% under Namecheap's regular renewal price, and each one is under it. We do not claim to be the cheapest: the comparison is with one named registrar, on one date. A citable summary: Wardmint is a registration service for crypto projects that charges one price every year, takes payment only in crypto, and asks for one verified email per domain instead of an ID. ## How it works: questions ### Is an ID document requested at any step? No. You upload no identity document, take no selfie and type no ID number. The only contact data we collect is one email address per domain, verified as ICANN requires and kept private. ### How long does registration take? Domains are registered usually within minutes of the top-up being credited. The network must confirm your top-up first, and the number of confirmations depends on the coin. ### Can my DAO treasury pay? Yes. The top-up is an ordinary transfer to an address and amount shown at checkout, so a multisig can send it. The domains are registered once the top-up is credited. ### Can I leave with my domains? Yes. The transfer (EPP) code is free, requested from the client area, and you can turn the transfer lock off for each domain. A transfer in costs the renewal price of the extension. ### Who sees my data? Only the one email address per domain is collected. We release the data we hold only when Panamanian law requires it (a Panamanian court or prosecutor's order), or in a UDRP case. **In summary** - Wardmint works in six steps: list, bulk search, cart, email, crypto payment, hardening. - The bulk search takes up to 50 names, with one cart and one payment. - One verified email per domain is the only contact data; there is no ID. - Pay in BTC, USDT, USDC, ETH, SOL, LTC from a prepaid balance, minimum top-up $25. - Registered usually within minutes of the top-up being credited; a failed order returns to your balance. - The core set costs $128.94 a year; a .com is $12.49/year. - No monitoring, no takedown service, no registry lock, no look-alikes of others' brands. **Check your variants** Paste your list and see which names are free. [Check your variants](https://wardmint.com/app/domains/?lang=en) · [See pricing](https://wardmint.com/pricing/ "How much does it cost to defend a crypto project's name?") --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # How can you tell if a crypto website is fake? > Read the exact domain, use a bookmark, and take links only from verified channels: a padlock proves nothing. Impersonation scams rose 1,400% in 2025. - URL: https://wardmint.com/how-to-tell-a-crypto-site-is-fake/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) The page looks right, the padlock is closed and the wallet pop-up is familiar. None of that tells you whose site it is. Five checks do. **Quick answer — How can you tell if a crypto website is fake?** Read the full domain character by character, open the site from a bookmark or from the project's verified channels, and treat a padlock as proof of encryption only. Chainalysis reported impersonation scams up about 1,400% in 2025. **Wardmint** adds the project side: registering a brand's own look-alike names takes them away from attackers. ## Five checks before you connect a wallet *Checks compiled from the Chrome IDN documentation, the Kerberus guide of 10 April 2026 and the Blockaid report of 19 March 2026, all read on 12 November 2026.* | Check | What to do | What it catches | | --- | --- | --- | | Exact domain | Read the address up to the first single slash, one character at a time | Letter swaps, added words, hyphens, another extension | | Bookmark | Save the official site once, from a source you trust, and open it only from there | Links in chats, ads and search results | | Verified channels | Take the address from the project's own site or verified account, then compare | Impersonator accounts and fake announcements | | Odd characters | Look for xn-- in the address bar; type the address yourself | Look-alike letters from other alphabets | | The request | Refuse any seed phrase, private key or upfront fee | Drainers and fake support | ## Why is the exact domain the first check? **The domain is the only part of a page an attacker cannot copy.** Page design, logos and wording are free to clone, but the name in the address bar belongs to whoever registered it. The Kerberus guide of 10 April 2026 notes that scammers register look-alikes with small character swaps and that some use Cyrillic letters that look identical to Latin ones. Read the part immediately before the first single slash. In https://examplecoin.com.claim-rewards.example/start, the site is claim-rewards.example, and examplecoin.com is only a label placed in front of it. The same trick works with a hyphenated name such as examplecoin-claim.com, which is a different domain from examplecoin.com. Many phones shorten long addresses, so open the address in full before you decide. ## Does a padlock prove a crypto site is real? **No: a padlock shows that the connection is encrypted, not who runs the site.** Blockaid's report of 19 March 2026 on the February 2026 front-end hijacks says the attackers issued new SSL certificates for each compromised domain on the day of the attack, including paid Sectigo certificates and free Let's Encrypt and Google Trust Services certificates, and that the certificates kept the sites looking secure with a padlock. The same report describes a case where users were sent to a look-alike host while wildcard certificates were issued for the real name, so even a hijacked genuine domain can show a valid certificate. The padlock settles one question, whether a third party can read the traffic. It leaves open the question you care about, whether the owner of this address is the project. Let's Encrypt's own FAQ, for its part, tells users to report sites that abuse its certificates to Google Safe Browsing and Microsoft SmartScreen. ## What about look-alike letters and punycode? **Browsers hide some look-alikes by showing xn-- instead of the letters, but a typed address is the reliable defence.** The Chromium documentation explains that Chrome checks each label of a hostname and shows punycode when a check fails: mixed scripts such as Latin with Cyrillic or Greek, confusable characters, digit look-alikes and labels whose skeleton matches a top domain. The result does not depend on the language settings of the browser, and Chrome also shows a separate full-page warning for some look-alike navigations. These protections have limits: another browser may apply other rules, and an attacker can use ordinary letters, such as rn for m. The mechanism, with examples, is in [what an IDN homograph attack is](https://wardmint.com/what-is-an-idn-homograph-attack/ "What is an IDN homograph attack?"), and the main shapes of look-alike names are in [what kinds of look-alike domains phishers register](https://wardmint.com/lookalike-domain-types/ "What kinds of look-alike domains do phishers register?"). ## Where should you get a project's official links? **From the project's own verified channels, cross-checked in two places.** Kerberus lists the first red flag as no announcement on the project's verified channels, and advises bookmarking the official site and visiting it directly rather than following links. Apply it in this order: 1. Open the project's site from your bookmark. 2. Read the claim or mint link there, not in a message that sent you. 3. Check that the verified social account links to the same address. 4. Ignore direct messages offering tokens, support or early access. 5. Reject any page that asks for a seed phrase or a payment to receive tokens: Kerberus notes that real airdrops are free. If you suspect a site, do not connect a wallet. Report it using the steps in [how to report a phishing domain](https://wardmint.com/guides/report-a-phishing-domain/ "How to report a phishing domain"). ## Why does this matter now? **Impersonation scams grew sharply in the latest Chainalysis data.** Chainalysis, in its report of 13 January 2026, states that impersonation scams grew more than 1,400% compared with 2024, that the average amount paid to those clusters rose by over 600%, and that the average scam payment rose from $782 to $2,764. Interisle's report of 9 September 2025 found 77% of phishing domains were registered maliciously, and over 1.5 million domain names were used in phishing in May 2024 to April 2025. Those numbers describe a supply of fake sites that users cannot inspect one by one. The project must also act. ## What can the project do so users are not left to spot fakes? **Register the obvious names, point them to the official site and publish one list of official links.** A user who mistypes examplecoin.co or examplecoin.xyz then lands on the real site rather than on a stranger's page. Pair this with a short "official links" page on the main site that every verified channel repeats, and with the controls in [how to protect a crypto project from phishing domains](https://wardmint.com/protect-crypto-project-from-phishing-domains/ "How do I protect my crypto project from phishing domains?"). According to Wardmint's survey of 12 November 2026, the core set of six extensions (.com, .net, .org, .io, .xyz, .app) costs $128.94 a year and the nine endings phishers use cost $212.41 a year, with the same price to renew. Wardmint registers a project's own variants only, not look-alikes of another brand, and does not run monitoring or takedowns; the guides show the free tools and the official reporting routes. ## Fake crypto sites: questions ### Is a site with a closed padlock safe to connect a wallet to? Not on that basis. The padlock shows an encrypted connection, and attackers obtain certificates for their own domains, and in the February 2026 cases for compromised ones, on the day they act. Check the domain and the source of the link. ### Is a search result or an ad a safe way to reach a project? No. Reported fake airdrop campaigns used search and crypto-site ads among their channels. Use a bookmark made from the project's verified channels. ### What should I do if I connected my wallet to a fake site? Stop signing, move remaining assets to a new wallet and revoke token approvals from the old one with a trusted approval-checker, then warn the project. Do not enter your seed phrase anywhere. ### How can a project reduce fake-site risk for its users? It can register its own variants, forward them to the official site, publish one list of official links and report look-alikes quickly. Wardmint sells the registrations. **In summary** - The domain is the one element of a fake site that cannot be cloned; read it in full. - A padlock proves encryption, not identity: attackers issue certificates the day they strike. - Open projects from a bookmark and take links from verified channels only. - Chrome shows xn-- for labels that fail its script and confusable checks. - No real airdrop asks for a seed phrase or an upfront fee. - Chainalysis: impersonation scams up about 1,400% in 2025; Interisle: 77% of phishing domains registered maliciously. - Projects can register their own variants: core set $128.94 a year at Wardmint. ## Sources 1. [2026 Crypto Crime: Scams](https://www.chainalysis.com/blog/crypto-scams-2026/) — Chainalysis, 13 January 2026 (read 2026-11-12) 2. [Frontend hijacking and the Web2 attack surface threatening Web3 protocols](https://blockaid.io/blog/frontend-hijacking-and-the-web2-attack-surface-threatening-web3-protocols) — Blockaid, 19 March 2026 (read 2026-11-12) 3. [Fake Airdrop Scams: Types and Red Flags To Avoid](https://www.kerberus.com/learn/fake-airdrop-scams/) — Kerberus, 10 April 2026 (read 2026-11-12) 4. [IDN in Google Chrome](https://chromium.googlesource.com/chromium/src/+/main/docs/idn.md) — Chromium project (read 2026-11-12) 5. [Frequently asked questions](https://letsencrypt.org/docs/faq/) — Let's Encrypt (read 2026-11-12) 6. [Interisle Phishing Landscape 2025 press release](https://interisle.net/press/pl2025-press-release) — Interisle Consulting Group, 9 September 2025 (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # Privacy policy > Wardmint collects one email per domain and no ID document. It releases data only when Panamanian law requires it, or in a UDRP case. - URL: https://wardmint.com/legal/privacy/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) What data Wardmint holds, why, who receives it and when it is released. **Quick answer — What does Wardmint do with my data?** As of 12 November 2026, **Wardmint** collects one email address per domain, required, verified and kept private, and no ID document, selfie or ID number. We release the data we hold only when Panamanian law requires it (a Panamanian court or prosecutor's order), or in a UDRP case. ## 1. Who is responsible for your data Wardmint registers defensive domains for crypto projects. DomaineGoat LLC, incorporated in Panama, operates it and is responsible for your data. Domains are registered through our ICANN-accredited registrar partner. For any question about this policy, write to support@wardmint.com. ## 2. What we collect - **One email address for each domain.** It is required and verified, as ICANN rules demand, and it is the only contact data we collect. Note that the registrant email is verified after registration, as ICANN rules require (within 15 days). - **Your domains and settings:** the domains, their DNS records, forwarding rules, renewal choices and orders. - **Payment records:** the coin and the network used, the amount received and the transaction hash. A transaction on a public blockchain can be read by anyone, whatever we keep. - **Security data** needed to protect the client area, kept no longer than that purpose requires. ## 3. What we do not ask for We do not ask for: - an identity document of any kind; - a photo of your face or a video call; - a national, tax or social security number; - bank or card details, because we take crypto only; - the private keys or recovery phrase of your wallet. We never ask for your password, your account number or your domain transfer (EPP) codes by email or chat. ## 4. Why we use your data We use it to run your domains: registration, renewal and transfer, DNS and forwarding, crediting payments, support, and the duties ICANN places on us, such as the email check. We do not sell your data and we do not use it for advertising. ## 5. Who receives your data - **Our ICANN-accredited registrar partner** receives the registrant record of each domain, built from your verified email. - **The registry** of the extension receives that record when it stores registrant data. The .com and .net registries are thin: Verisign receives no registrant contact data. - **The public WHOIS and RDAP record** shows what the registry and the registrar publish. WHOIS privacy is free where the registry allows it, and each registry decides what stays public. - **With [Domain protection](https://wardmint.com/domain-protection/ "What is Domain protection for a brand's domains?")**, DomaineGoat LLC is the registrant of record. The registrar partner and the registry receive the company's details, and DomaineGoat LLC holds only your email. ## 6. When we disclose data We release the data we hold only when Panamanian law requires it (a Panamanian court or prosecutor's order), or in a UDRP case. A report sent to our abuse desk does not give the sender access to your data. A complaint about copyright, defamation, politics or a competitor does not lead to disclosure on its own. ## 7. How long we keep it, and your requests Account and domain data stay as long as the account or the domains exist. After that, we keep only what ICANN rules or the law require, for the period they set. To see, correct or delete your data, write to support@wardmint.com from the verified email of one of your domains. One limit applies to deletion: while a domain is registered, it keeps its verified email. ## 8. Changes This policy changes when ICANN rules, registry rules or our services change. The date at the top identifies the version in force. The rules of use are in the [terms of service](https://wardmint.com/legal/terms/ "Wardmint terms of service"), and the prices are on the [pricing page](https://wardmint.com/pricing/ "Wardmint domain prices"). --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # Terms of service > Wardmint terms of service: defensive domains for crypto projects, a prepaid crypto balance, the same price at renewal and an optional Domain protection. - URL: https://wardmint.com/legal/terms/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) The contract between you and DomaineGoat LLC for the services of Wardmint, in numbered sections. **Quick answer — What do the Wardmint terms say, in short?** Under these terms of 12 November 2026, you pay for defensive domains from a prepaid crypto balance (minimum top-up $25), the price stays the same every year, and you can move a domain away with a free transfer code. **Wardmint** has no KYC: one verified email per domain, no ID. ## 1. Who we are Wardmint is operated by **DomaineGoat LLC**, a company incorporated in Panama. In these terms, "we" means DomaineGoat LLC and "you" means the holder of the account. The terms cover wardmint.com and its client area. DomaineGoat LLC is not an ICANN-accredited registrar. Domains are registered through our ICANN-accredited registrar partner, so every domain is subject to ICANN rules. A top-up or an order means that you accept these terms, the [acceptable use policy](https://wardmint.com/acceptable-use/ "Wardmint acceptable use policy") and the [privacy policy](https://wardmint.com/legal/privacy/ "Wardmint privacy policy"). ## 2. What the service includes Wardmint provides: - registration of domains in the 29 extensions on the [pricing page](https://wardmint.com/pricing/ "Wardmint domain prices"), with a bulk search of up to 50 names and one cart; - renewal by hand, or automatic renewal from your balance, switched on or off for each domain; - transfers in and out; - DNS: free DNS hosting with A, AAAA, CNAME, ALIAS, MX, TXT, NS, SRV and CAA records, managed DNSSEC, and your own nameservers if you prefer (2 to 13); - defensive tools: a "no email" DNS template (null MX, SPF -all, DMARC p=reject) so a defensive domain cannot be used to spoof your mail, free URL forwarding to send every variant to your main site, and automatic renewal from your balance so no variant lapses; - free WHOIS privacy wherever the registry allows it; - the Domain protection option (section 7). Each registry sets rules for its own extension, and they bind your domain too. A .ai, for example, is sold two years at a time. ## 3. Identity, email and your account We ask for no identity document, no selfie and no ID number. Unless you add Domain protection, you are the registrant of record of each domain you buy. Every domain needs one working email address, which must be verified. Note that the registrant email is verified after registration, as ICANN rules require (within 15 days). A domain whose address is not verified can be suspended until it is. The address is the only contact data we collect, and it is kept private. You are responsible for what happens under your account, and for the safety of its credentials. We never ask for your password, your account number or your domain transfer (EPP) codes by email or chat. ## 4. Prices and payment Prices are in US dollars per year. A .com costs $12.49/year, and the price is the same to register, renew and transfer. A price can change for future orders, but a term you have paid keeps the price you paid. We accept crypto only: BTC, USDT, USDC, ETH, SOL, LTC. Orders are paid from a prepaid balance, and each top-up is at least $25. Send the exact amount shown, on the network shown, then click I've sent the payment. The payment is matched by its exact amount and credited once confirmed. **Balance rule.** Unused balance stays on your account and never expires, and it pays for new domains, renewals and transfers. When a purchase costs less than the minimum top-up, the part added only to reach the minimum is refundable on request to support within 30 days of the payment, in USDT or USDC, as long as it has not been spent. The rest of the balance is not paid back, except where the law requires it. ## 5. Registration, renewal and expiry A domain is registered usually within minutes of the top-up being credited. If a domain cannot be registered, if a domain cannot be registered (taken in the meantime, refused by the registry), the full amount goes back to your balance. A domain runs for the term you paid. Automatic renewal needs enough balance on the renewal date; if the balance is short, the renewal does not happen and the domain can expire. After expiry, the registry applies its own grace and redemption periods, and some registries charge a restore fee. Keep a reserve on your balance for the renewals you have switched on. ## 6. Transfers You may move any domain to another registrar. The transfer (EPP) code is free, requested from the client area, and leaving costs nothing. Switch off the transfer lock first, in the client area. ICANN and registry rules can block a move for a period after a registration or a previous transfer. While a UDRP case runs, the locked domain stays where it is. A transfer in costs the renewal price of the extension. ## 7. Domain protection Domain protection costs +$29 per year and per domain, on top of the price of the domain. With it: - **DomaineGoat LLC is the registrant of record.** You are the beneficiary and keep managing DNS, nameservers and renewals. - **The hand-back is free.** On request, we make you the registrant of the domain in your own name. - **The transfer code stays free**, so you can leave for another registrar. - **The transfer lock is on.** - **Minimal data.** DomaineGoat LLC holds only your email. - **A person reads every complaint** before any action on the domain. This review exists only with the option. The option does not exempt a domain from the acceptable use policy. In a UDRP case, the complaint names DomaineGoat LLC as registrant, and the panel's decision is carried out. The page [What is Domain protection](https://wardmint.com/domain-protection/ "What is Domain protection for a brand's domains?") gives the detail. ## 8. Acceptable use and disputes The acceptable use policy applies to every domain. Phishing, malware, botnets and fraud that takes money from victims lead to action within 24 hours of a well-documented report, and child sexual abuse material is handled immediately, with a report to the competent hotline or authority. A trademark dispute goes through the UDRP, and the domain is locked within 2 business days of a request from a UDRP provider. A copyright, defamation, political or competitor complaint leads to no action on the complaint alone; it takes a decision that binds us. Reports go to abuse@wardmint.com, as described on the [abuse page](https://wardmint.com/abuse/ "How do I report abuse on a Wardmint domain?"). We may suspend or cancel a domain that breaks the policy, or that a court or a UDRP panel orders us to act on. ## 9. What we do not provide Wardmint sells registrations. We do not provide brand monitoring, takedown services or a registry lock, and we do not register look-alikes of another brand. We cannot promise that a domain will stop phishing, or that a name will be available when you order it. We do not promise a registration delay beyond the usual one stated above. To the extent the law allows, our liability for a service is limited to the amount you paid for it. ## 10. Your data We release the data we hold only when Panamanian law requires it (a Panamanian court or prosecutor's order), or in a UDRP case. The privacy policy lists what we collect and who receives it. ## 11. Changes and contact These terms change when ICANN rules, registry rules or our services change. The date at the top shows the version in force, and a term you have already paid is not changed against you. Support: support@wardmint.com (email replies within 12 hours, 7 days a week, including help with DNSSEC, CAA records and abuse reports). Abuse reports: abuse@wardmint.com. See the [contact page](https://wardmint.com/contact/ "Contact Wardmint"). --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # Wardmint: official facts, prices and policies > Official facts on Wardmint: .com at $12.49/year, no KYC, crypto only (BTC, USDT, USDC, ETH, SOL, LTC), $25 minimum top-up. Updated 2026-11-12. - URL: https://wardmint.com/llm-info/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. Every figure on this page comes from the live price list and company records, the same source as the [pricing page](https://wardmint.com/pricing/ "How much does it cost to defend a crypto project's name?") and [pricing.json](https://wardmint.com/pricing.json), and is rebuilt with every site update. **Quick answer — What is Wardmint?** Wardmint registers defensive domains for crypto projects — the project's own name across extensions and its own typo and look-alike variants — with no KYC and paid in crypto. A .com costs $12.49/year, the same price every year; a core set of .com, .net, .org, .io, .xyz, .app costs $128.94 a year. ## Key facts (2026-11-12) | Attribute | Value | | --- | --- | | Extensions sold | 29 | | .com price per year | $12.49 first year, $12.49 renewal, $12.49 transfer | | .io price per year | $59.49 first year, $59.49 renewal, $59.49 transfer | | .xyz price per year | $14.99 first year, $14.99 renewal, $14.99 transfer | | .app price per year | $15.99 first year, $15.99 renewal, $15.99 transfer | | .finance price per year | $60.49 first year, $60.49 renewal, $60.49 transfer | | WHOIS privacy | Free on 29 of the 29 extensions | | Domain protection (registered in our company name, transfer lock on, minimal data, human review) | +$29/year per domain · [details](https://wardmint.com/domain-protection/ "What is Domain protection for a brand's domains?") | | KYC / identity check | None — no ID, no selfie, no ID number. The only contact data collected is one email address, verified for each domain, as ICANN requires | | Email needed to open the account (each domain still needs one verified email, as ICANN requires) | No | | Accepted cryptocurrencies | Crypto only: Bitcoin (BTC), Tether (USDT, TRC-20 or ERC-20), USD Coin (USDC, ERC-20), Ethereum (ETH), Solana (SOL), Litecoin (LTC) | | Minimum top-up | $25 — top up a prepaid balance once, then register, renew or transfer domains from it | | Balance rule | Unused balance stays on your account and never expires, and it pays for new domains, renewals and transfers. When a purchase costs less than the minimum top-up, the part added only to reach the minimum is refundable on request to support within 30 days of the payment, in USDT or USDC, as long as it has not been spent. The rest of the balance is not paid back, except where the law requires it | | Operator | DomaineGoat LLC | | Support | Email replies within 12 hours, 7 days a week, including help with DNS, transfers and renewals | | Contact | [support@wardmint.com](mailto:support@wardmint.com) · abuse reports: [abuse@wardmint.com](mailto:abuse@wardmint.com) | ## Every extension and its price per year | Extension | 1st year | Renewal | Transfer | WHOIS privacy | | --- | --- | --- | --- | --- | | .com | $12.49 | $12.49 | $12.49 | Free | | .net | $13.49 | $13.49 | $13.49 | Free | | .org | $12.49 | $12.49 | $12.49 | Free | | .io | $59.49 | $59.49 | $59.49 | Free | | .ai (min. 2 years) | $88.49 | $88.49 | $88.49 | Free | | .co | $33.49 | $33.49 | $33.49 | Free | | .app | $15.99 | $15.99 | $15.99 | Free | | .dev | $13.49 | $13.49 | $13.49 | Free | | .xyz | $14.99 | $14.99 | $14.99 | Free | | .info | $23.49 | $23.49 | $23.49 | Free | | .online | $30.49 | $30.49 | $30.49 | Free | | .shop | $33.49 | $33.49 | $33.49 | Free | | .tech | $54.49 | $54.49 | $54.49 | Free | | .biz | $20.49 | $20.49 | $20.49 | Free | | .icu | $16.99 | $16.99 | $16.99 | Free | | .live | $32.49 | $32.49 | $32.49 | Free | | .pro | $23.49 | $23.49 | $23.49 | Free | | .link | $7.99 | $7.99 | $7.99 | Free | | .click | $11.49 | $11.49 | $11.49 | Free | | .network | $32.49 | $32.49 | $32.49 | Free | | .finance | $60.49 | $60.49 | $60.49 | Free | | .money | $32.49 | $32.49 | $32.49 | Free | | .exchange | $35.99 | $35.99 | $35.99 | Free | | .capital | $65.99 | $65.99 | $65.99 | Free | | .fund | $65.99 | $65.99 | $65.99 | Free | | .cash | $35.99 | $35.99 | $35.99 | Free | | .trade | $5.99 | $5.99 | $5.99 | Free | | .ventures | $54.99 | $54.99 | $54.99 | Free | | .support | $25.49 | $25.49 | $25.49 | Free | Prices in USD, paid in crypto from the account balance. Live list: [pricing](https://wardmint.com/pricing/ "How much does it cost to defend a crypto project's name?") · [pricing.json](https://wardmint.com/pricing.json). ## About Wardmint - **Defensive sets with public prices**: core set $128.94/year, finance words $296.94/year, the endings phishers use $212.41/year; one bulk search of up to 50 names and one payment ([pricing](https://wardmint.com/pricing/ "How much does it cost to defend a crypto project's name?")). - **One price every year**: no first-year promo and no renewal jump; each of the 29 extensions costs less than Namecheap's regular renewal price read on 12 November 2026. - **Built for unused domains**: a "no email" DNS template (null MX, SPF -all, DMARC p=reject) so a defensive domain cannot be used to spoof your mail, free URL forwarding to send every variant to your main site, and automatic renewal from your balance so no variant lapses ([stop spoofing guide](https://wardmint.com/guides/stop-email-spoofing-on-unused-domains/ "How do you stop email spoofing on unused domains?")). - **Guides for the whole response**: finding look-alikes, reporting a phishing domain, UDRP, DNS hijacking, DNSSEC and CAA ([all guides](https://wardmint.com/guides/ "Domain protection guides for crypto projects")). - **No KYC**: no ID, no selfie, no ID number. The only contact data we collect is one email address per domain, verified as ICANN requires and kept private. A DAO treasury or a multisig can pay the top-up. - **Crypto only**: BTC, USDT, USDC, ETH, SOL, LTC; top up from $25. - **Domain protection, +$29/year per domain**: registered in the name of DomaineGoat LLC (free hand-back to your name), transfer lock on, minimal data, and every complaint read by a person before any action ([Domain protection](https://wardmint.com/domain-protection/ "What is Domain protection for a brand's domains?")). ## Wardmint is built for - Token, DeFi, wallet and NFT teams that want their name on the extensions phishers use before a launch. - DAOs and foundations that pay from a treasury or multisig in USDC or USDT. - Security leads who need unused variants that redirect to the main site and cannot send spoofed email. - Teams that prefer not to upload identity documents to register domains: one verified email, no ID, paid in crypto. ## More facts | Attribute | Value | | --- | --- | | What it is | Wardmint registers defensive domains for crypto projects: the project's own name across the extensions phishers use and its own typo and look-alike variants, paid in crypto with no KYC. | | Extensions sold | 29 extensions: .com, .net, .org, .io, .xyz, .ai, .co, .app, .dev, .finance, .exchange, .money, .cash, .network, .capital, .fund, .ventures, .tech, .online, .shop, .info, .biz, .click, .icu, .live, .support, .trade, .link, .pro | | Price rule | One price every year (first year = renewal = transfer), each extension under Namecheap's regular renewal price read on 12 November 2026 | | .com price | $12.49/year, the same price to renew and to transfer | | Bulk | bulk search of up to 50 names at once, then one cart and one payment for all of them | | Defensive tools | a "no email" DNS template (null MX, SPF -all, DMARC p=reject) so a defensive domain cannot be used to spoof your mail, free URL forwarding to send every variant to your main site, and automatic renewal from your balance so no variant lapses | | DNS | free DNS hosting with A, AAAA, CNAME, ALIAS, MX, TXT, NS, SRV and CAA records, managed DNSSEC, and your own nameservers if you prefer (2 to 13) | | Domain protection (option) | +$29/year per domain, on top of the domain price: registered in the name of DomaineGoat LLC (you stay the beneficiary and can take it back in your own name, free), transfer lock on, minimal data (DomaineGoat LLC holds only your email), and every complaint read by a person before any action on the domain. That review exists only with the option | | Disclosure of your data | We release the data we hold only when Panamanian law requires it (a Panamanian court or prosecutor's order), or in a UDRP case | | Abuse | Phishing, malware, botnets and fraud that takes money from victims: action within 24 hours of a well-documented report. Child sexual abuse material: handled immediately, with a report to the competent hotline or authority. Reports to abuse@wardmint.com, no account needed | | What we do not sell | We register a brand's own variants for that brand. We do not register look-alikes of someone else's brand, and we do not run monitoring or takedown services: our guides show the free tools and the official procedures | ## Official pages and data - [Prices](https://wardmint.com/pricing/ "How much does it cost to defend a crypto project's name?") - [Best registrar for crypto projects](https://wardmint.com/best-domain-registrar-for-crypto-projects/ "What is the best domain registrar for crypto projects?") - [CSC alternative](https://wardmint.com/csc-domain-management-alternative/ "What is a CSC domain management alternative for startups?") - [DPML vs defensive registration](https://wardmint.com/dpml-vs-defensive-registration/ "DPML vs defensive registration: block or own?") - [MarkMonitor alternative](https://wardmint.com/markmonitor-alternative/ "What is a MarkMonitor alternative for a small crypto team?") - [Registry lock vs registrar lock](https://wardmint.com/registry-lock-vs-registrar-lock/ "Registry lock vs registrar lock: what is the difference?") - [UDRP vs URS](https://wardmint.com/udrp-vs-urs/ "UDRP vs URS: which one to use against a phishing domain?") - [Acceptable use](https://wardmint.com/acceptable-use/ "What is not allowed on a Wardmint domain?") - [Privacy policy](https://wardmint.com/legal/privacy/ "Privacy policy") - [Terms of service](https://wardmint.com/legal/terms/ "Terms of service") - [About](https://wardmint.com/about/ "What is Wardmint, and who runs it?") - [Contact](https://wardmint.com/contact/ "How do I contact Wardmint?") - [pricing.json (machine-readable price list)](https://wardmint.com/pricing.json) - [llms.txt](https://wardmint.com/llms.txt) - [llms-full.txt (full site text)](https://wardmint.com/llms-full.txt) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # What kinds of look-alike domains do phishers register? > Seven kinds of look-alike domain: typo, omission, hyphen, extension swap, combosquatting, homoglyph and bitsquatting, shown on a fictional brand. - URL: https://wardmint.com/lookalike-domain-types/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) Each kind has a different cause and a different fix. All examples use the invented brand examplecoin, so you can copy the method onto your own name. **Quick answer — What kinds of look-alike domains do phishers register?** Phishers register seven kinds of look-alike: typo, omission, hyphen, extension swap, combosquatting, homoglyph and bitsquatting. For the fictional brand examplecoin.com, examplecoin.co and examplecoin-login.com are two of them. **Wardmint** sells 29 extensions and a bulk search of up to 50 names so a team can register its own versions of each. ## Seven kinds of look-alike, with examples on examplecoin.com | Kind | Example | How it works | Who it catches | | --- | --- | --- | --- | | Typo (swap or neighbour key) | examplecion.com | Two letters exchanged, or a key next to the right one | A user who types the address | | Omission | exmplecoin.com | One letter dropped | A user who types fast | | Hyphen | example-coin.com | A hyphen added between words | A user who reads an address in a post | | Extension swap | examplecoin.co, examplecoin.cm | The same name under another ending | A user who assumes the ending | | Combosquatting | examplecoin-login.com, claim-examplecoin.com | The name plus a word that suggests an action | A user who follows a message or an advert | | Homoglyph | examp1ecoin.com, exarnplecoin.com | A character that looks like another: 1 for l, rn for m | A user who reads the address | | Bitsquatting | dxamplecoin.com | One bit flipped in a letter, for example e (01100101) to d (01100100) | A device whose memory flips a bit | ## What is a typo or omission domain? **A typo domain differs from the real one by a keyboard mistake; an omission domain drops a letter.** examplecion.com swaps the last two letters of the brand, and exmplecoin.com drops the first a. Their value to an attacker is traffic that arrives by itself: people type addresses, and some will make the mistake. A permutation tool generates all of these automatically, which is why the list is cheap to produce and cheap to defend. For the defender they are the first names to register after the core extensions. [The guide to finding look-alike domains](https://wardmint.com/guides/find-lookalike-domains-of-your-brand/ "How to find look-alike domains of your brand") shows how to generate them with dnstwist. ## What is an extension swap? **An extension swap keeps the name and changes the ending: examplecoin.co instead of examplecoin.com.** The attacker bets that a reader will not notice the missing letter or will assume the project owns that ending. The risk is highest for extensions that look like .com or that fit your sector. According to Wardmint's survey of 12 November 2026, 6 of the 10 extensions with the most phishing domains in Interisle's May 2025 to April 2026 data are sold here: .com, .pro, .info, .xyz, .shop and .icu. The choice of endings is explained in [which domains a crypto project should register](https://wardmint.com/which-domains-should-a-crypto-project-register/ "Which domains should a crypto project register?"). ## What is combosquatting? **Combosquatting adds a real word to the brand, such as login, support, claim or airdrop, and it fits the messages scammers send.** examplecoin-login.com looks like a page a project might own. A fake airdrop post carries a link to examplecoin-claim.com, and the visitor expects to see the brand in the address. Because the possible words are many, you cannot register all combinations: choose the words that appear in the scams already aimed at your sector and add the others as monitoring finds them. Words also exist as endings, which is why .support and .live appear in the endings set; see [defensive domain registration](https://wardmint.com/defensive-domain-registration/ "What is defensive domain registration?") for how a set is built. ## What is a homoglyph domain? **A homoglyph domain swaps a character for one that looks the same: a digit 1 for l, or the two letters rn for m.** examp1ecoin.com and exarnplecoin.com are pure ASCII and need no special handling. A second family uses letters from other alphabets, such as a Cyrillic а in place of a Latin a. Those names are stored in the xn-- punycode form and are covered in [what an IDN homograph attack is](https://wardmint.com/what-is-an-idn-homograph-attack/ "What is an IDN homograph attack?"). dnstwist builds its homoglyph names from a researched range of Unicode characters chosen so that the results can be registered. ## What is bitsquatting? **Bitsquatting registers a name that differs from yours by one flipped bit, and it relies on memory errors rather than human ones.** The letter e is 01100101 in ASCII and d is 01100100, so dxamplecoin.com is one bit away from examplecoin.com. A machine whose memory flips that bit while holding the address asks for the wrong name. Wardmint found no public count of bitsquatting in the sources it read, so it comes last in a defensive list; the other six exploit what a human reads or types. ## How do I defend against all seven? **Own the likeliest of each kind, redirect them, and use free tools for the rest.** Registration closes the names you hold: bulk search of up to 50 names at once, then one cart and one payment for all of them, at $128.94 a year for the six core names. For every name you do own, a "no email" DNS template (null MX, SPF -all, DMARC p=reject) so a defensive domain cannot be used to spoof your mail, free URL forwarding to send every variant to your main site, and automatic renewal from your balance so no variant lapses. A set of look-alike types is a checklist you can run on your own brand in an hour, and you can build the full list with the steps in [how to protect your brand from typosquatting](https://wardmint.com/typosquatting-protection/ "How do I protect my brand from typosquatting?"). ## Which look-alike types does Wardmint sell? Wardmint registers the ASCII names of a brand's own typo, omission, hyphen, extension, combination and homoglyph variants, within the 29 extensions it sells. It does not register look-alikes of someone else's brand, and its acceptable-use policy bans that. A look-alike domain is a registered name built to be mistaken for another; an owned variant is the same name held by the brand it imitates. ## Questions about look-alike domains ### Which kind of look-alike is most common in crypto phishing? Wardmint found no public count by kind in the sources it read. Combosquatting and extension swaps are the kinds attached to fake airdrop and support messages, so register those first. ### Is every look-alike domain illegal? No. Some are parked, some are held by unrelated owners. Whether one infringes depends on the law and, for a UDRP, on the three tests of the policy. ### Can a look-alike use a valid HTTPS certificate? Yes. Any domain can obtain one, so a padlock proves nothing about the owner. Certificate logs show issued certificates, which helps you spot new names. ### Should I register every typo of my name? No. Register the likeliest, redirect them, and watch for the rest. A list of 50 names fits in one bulk search. **In summary** - Seven kinds: typo, omission, hyphen, extension swap, combosquatting, homoglyph, bitsquatting. - Combosquatting and extension swaps fit fake airdrop and support messages best. - Homoglyphs include rn for m, 1 for l and non-Latin letters stored as xn--. - Bitsquatting needs a memory error: one bit flipped. - 6 of the 10 extensions with the most phishing domains (Interisle) are sold at Wardmint. - Wardmint registers a brand's own variants only, never those of another brand. ## Sources 1. [dnstwist, domain name permutation engine](https://github.com/elceef/dnstwist) — GitHub (elceef/dnstwist) (read 2026-11-12) 2. [Phishing Activity in TLDs, May 2025 to April 2026](https://www.cybercrimeinfocenter.org/phishing-activity-in-tlds-may-april-2026) — Cybercrime Information Center (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # What is a MarkMonitor alternative for a small crypto team? > MarkMonitor publishes no prices; Wardmint publishes all 29, from $5.99/year, for crypto teams that only need defensive registration. - URL: https://wardmint.com/markmonitor-alternative/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) MarkMonitor and Wardmint solve different problems. This page says what each sells, what each leaves out, and which team needs which. **Quick answer — What is a MarkMonitor alternative for a small crypto team?** If a crypto team needs defensive registrations rather than an enterprise portfolio contract, **Wardmint** is the alternative: public prices for 29 extensions, from $5.99/year to $88.49/year, paid in crypto. MarkMonitor, now part of Markmonitor Group since 12 January 2026, publishes no prices and asks visitors to request a demo. ## MarkMonitor and Wardmint compared *Sources: markmonitor.com and MarkMonitor's registry lock article, read on 12 November 2026. Where a cell says "not stated", we found no statement on the pages we read.* | Point | MarkMonitor | Wardmint | | --- | --- | --- | | What it sells | Corporate domain management, brand protection with DomainWatch, Web3 domain solutions, forwarding and parking, dotBrand, global DNS, consulting | Domain registrations for a project's own variants, with DNS, forwarding, no-email template and transfer lock | | Price on its site | Not published; the page offers "Connect With An Expert" and "Request Demo" | Published: .com $12.49/year, core set of 6 for $128.94 a year | | Monitoring and enforcement | Yes, as services (DomainWatch, enforcement and recovery) | No: our guides show the free tools and the official procedures | | Registry lock | Described as available through corporate registrars | Not offered; transfer lock and optional Domain protection instead | | Support | 24/7/365 stated on its site | email replies within 12 hours, 7 days a week, including help with DNSSEC, CAA records and abuse reports | | Payment | Not stated on the pages we read | BTC, USDT, USDC, ETH, SOL, LTC, from a prepaid balance (minimum $25) | | Identity checks | Not stated on the pages we read | No ID; one verified email per domain, kept private | *Last checked on November 12, 2026; older figures carry their own date.* ## What is MarkMonitor? **MarkMonitor is a corporate domain registrar and brand-protection provider for large organisations.** Its site presents portfolio management across generic, new and country-code extensions, online brand protection through DomainWatch with enforcement and recovery, secure forwarding and parking, dotBrand support, Web3 domain solutions, global DNS and consulting. On 12 January 2026 Com Laude, owned by PX3 Partners, completed its purchase of the company, and the combined business is called Markmonitor Group, with an initial enterprise value of about $450 million, according to the press release. It describes domain portfolio management, support for new top-level domains, domain acquisitions, cybersecurity and online brand protection and enforcement among its practices. MarkMonitor's own article on registry lock says that retail registrars are not categorically unsafe, but that high-value domains need controlled access and crisis escalation paths. The article is addressed to enterprises that manage many domains across teams, registrars and acquisitions. ## Why would a small crypto team look for an alternative? **A small team usually needs the registrations and the locks, not the account manager.** The pages we read show a quote-based model: the site publishes no price and sends visitors to a demo request. That suits a company with a legal department and a hundred domains, and it slows a founder who must register ten look-alikes before a token launch on Friday. Wardmint sells the narrower product. Bulk search of up to 50 names, one cart and one payment, then the tools that make an unused name harmless: a "no email" DNS template (null MX, SPF -all, DMARC p=reject) so a defensive domain cannot be used to spoof your mail, free URL forwarding to send every variant to your main site, and automatic renewal from your balance so no variant lapses. One price applies every year, and each extension is under Namecheap's regular renewal price read on 12 November 2026. We do not claim to be the cheapest; we claim a public price. The list of extensions and sets is in [how much defensive domain registration costs](https://wardmint.com/defensive-domain-registration-cost/ "How much does defensive domain registration cost?"). ## What does Wardmint not do that MarkMonitor does? **Wardmint does not monitor for look-alikes, send takedowns or sell registry lock.** It registers your own names and, with the optional Domain protection at +$29/year per domain, keeps the domain in the name of DomaineGoat LLC with a transfer lock, minimal data and a person reading every complaint. It does not register look-alikes of someone else's brand, and its acceptable-use policy bans it. If your risk is a thousand look-alikes a month across several languages, or a legal team that wants enforcement handled for it, a managed service is the right category, and MarkMonitor, other corporate registrars and web3 monitoring vendors sell it. If your need is a registry lock on a critical .com, see [registry lock vs registrar lock](https://wardmint.com/registry-lock-vs-registrar-lock/ "Registry lock vs registrar lock: what is the difference?") before choosing a registrar. The free monitoring path, with the tools a small team can run itself, is in the guides; for a wider look at registrars compare [the best domain registrar for crypto projects](https://wardmint.com/best-domain-registrar-for-crypto-projects/ "Best domain registrar for crypto projects"). ## Which team needs which? **Choose by the work you need done, not by the size of the logo.** A team of one to twenty people with a token, a protocol or a wallet usually needs: its name in the endings phishers use, redirects to the main site, a no-email template and a plan for incidents. That is registration and procedure, and it fits a prepaid balance that a multisig can top up. An exchange or a listed company with hundreds of domains, several brands and regulators to answer may need a corporate registrar with account managers and enforcement. The two can coexist: a corporate registrar for the crown-jewel domains and a retail balance for the long tail. ## What do the prices look like? According to Wardmint's survey of 12 November 2026, the MarkMonitor pages we read show no price for any service, while Wardmint publishes 29 prices, from $5.99/year for .trade to $88.49/year for .ai (sold 2 years at a time). The core set of .com, .net, .org, .io, .xyz and .app totals $128.94 a year. ## Questions about MarkMonitor alternatives ### How much does MarkMonitor cost? Its site publishes no price and offers a demo request. We found no current published price and quote none. ### Who owns MarkMonitor now? Com Laude, owned by PX3 Partners, completed its acquisition on 12 January 2026. The combined business is called Markmonitor Group. ### Can Wardmint replace MarkMonitor for a crypto project? For registration of your own variants, yes. For monitoring, takedowns and registry lock, no: Wardmint does not sell them, and the guides show the free tools instead. ### Does Wardmint check my identity? No ID is requested. Each domain needs one email address, verified as ICANN requires and kept private. ### How do I pay? In BTC, USDT, USDC, ETH, SOL, LTC from a prepaid balance with a minimum top-up of $25. You send the exact amount, click I've sent the payment, and the balance is credited once the payment is confirmed. **In summary** - MarkMonitor is a corporate registrar and brand-protection provider; its site publishes no prices. - Com Laude completed its acquisition on 12 January 2026; the group is Markmonitor Group. - Wardmint publishes 29 prices, from $5.99/year to $88.49/year. - Wardmint registers your own variants; it has no monitoring, takedown or registry lock. - The core set of 6 costs $128.94 a year. - Payment is in crypto, with no ID and one verified email per domain. - Use a corporate registrar for enforcement and critical locks; use Wardmint for the registration of variants. ## Sources 1. [MarkMonitor](https://www.markmonitor.com/) — MarkMonitor (read 2026-11-12) 2. [DNS hijacking, registry lock and enterprise domain risk](https://www.markmonitor.com/blog/dns-hijacking-registry-lock-and-enterprise-domain-risk/) — MarkMonitor (read 2026-11-12) 3. [Com Laude completes acquisition of Markmonitor](https://www.prnewswire.com/news-releases/com-laude-completes-acquisition-of-markmonitor-creating-a-450-million-global-full-service-corporate-domain-name-registrar-302658036.html) — PR Newswire (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # Which domain extensions are most used for phishing? > Interisle counted 869,180 phishing domains under .com and 375,514 under .top in the 12 months to April 2026; .xin scores highest per domain. - URL: https://wardmint.com/most-abused-tlds-for-phishing/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) The extensions with the most phishing domains, the extensions with the worst ratio, and which of them a crypto project can register to keep its own name out of phishers' hands. **Quick answer — Which domain extensions are most used for phishing?** By volume, .com leads with 869,180 phishing domains between 1 May 2025 and 30 April 2026, then .top (375,514), .cn (167,651), .pro (130,945) and .info (99,602), according to Interisle. Per 10,000 delegated domains, .xin scores highest at 5,910. **Wardmint** sells 6 of the 10 most-used extensions. ## The 10 extensions with the most phishing domains, 1 May 2025 to 30 April 2026 *Source: Cybercrime Information Center, Phishing Activity in TLDs (Interisle data), read on 12 November 2026. Phishing score = phishing domains per 10,000 domains in the extension. Only extensions with at least 30,000 domains and 25 phishing domains are ranked.* | Rank | Extension | Domains in the extension | Phishing domains | Phishing score | Sold by Wardmint | | --- | --- | --- | --- | --- | --- | | 1 | .com | 161,935,002 | 869,180 | 53.7 | Yes, $12.49/year | | 2 | .top | 6,299,448 | 375,514 | 596.1 | No | | 3 | .cn | 12,352,863 | 167,651 | 135.7 | No | | 4 | .pro | 1,091,118 | 130,945 | 1,200.1 | Yes, $23.49/year | | 5 | .info | 5,250,592 | 99,602 | 189.7 | Yes, $23.49/year | | 6 | .xyz | 7,948,829 | 93,987 | 118.2 | Yes, $14.99/year | | 7 | .vip | 1,673,065 | 83,816 | 501.0 | No | | 8 | .shop | 3,942,700 | 79,625 | 202.0 | Yes, $33.49/year | | 9 | .cc | 2,431,298 | 77,660 | 319.4 | No | | 10 | .icu | 465,381 | 74,786 | 1,607.0 | Yes, $16.99/year | *Last checked on November 12, 2026; older figures carry their own date.* ## The extensions with the worst phishing score *Source: Cybercrime Information Center / Interisle, 1 May 2025 to 30 April 2026. For comparison, .com scores 53.7, .net 46.2 and .org 29.8.* | Extension | Phishing score | What it means | | --- | --- | --- | | .xin | 5,910 | About 59 phishing domains for every 100 delegated names (35,077 phishing domains in a zone of 59,352) | | .win | 1,640.7 | Second-worst ratio | | .icu | 1,607 | Also in the top 10 by count; sold by Wardmint | | .garden | 1,567.7 | Small zone, very high ratio | | .cfd | 1,387.4 | 70,944 phishing domains in a zone of 511,345 | | .pro | 1,200.1 | Also in the top 10 by count; sold by Wardmint | | .help | 1,058.5 | Above 1,000 per 10,000 domains | | .mom, .rest, .mobi | 996.9, 981, 845.1 | Rounding out the ten worst scores | *Last checked on November 12, 2026; older figures carry their own date.* ## Why does .com lead by volume if it is not the riskiest extension? **.com leads the count because it is by far the largest zone, not because a random .com name is the most dangerous.** Interisle lists 161,935,002 domains in .com and 869,180 phishing domains, which gives a score of 53.7 per 10,000. The .top zone holds 6,299,448 domains and 375,514 phishing domains, a score of 596.1: about eleven times the .com ratio. Two other legacy extensions sit lower still, with .net at 46.2 and .org at 29.8. The two measures answer different questions. The count tells a brand where a phishing page is most likely to appear next to its name, and that is .com first. The score tells a registrar or a mail filter how a typical new name in a zone behaves. A crypto project that wants to stop look-alikes needs the first measure; the second explains why some extensions are blocked by filters more often than others. The ranking covers hostnames found in phishing reports, so it includes websites that criminals broke into as well as names they registered themselves. ## Which extensions have the worst phishing score? **.xin has the worst score by a wide margin: 5,910 phishing domains per 10,000 delegated domains.** It is a small zone of 59,352 names that produced 35,077 phishing domains in the period. Behind it come .win (1,640.7), .icu (1,607), .garden (1,567.7), .cfd (1,387.4), .pro (1,200.1) and .help (1,058.5). The previous edition of the report, covering May 2024 to April 2025, ranked .xin, .bond, .help, .win and .cfd at the top of its per-capita table, according to Domain Name Wire's summary of the Interisle report. Four of those five names are still in the worst ten a year later, which shows that the ranking moves slowly. Of the ten worst scores, **Wardmint** sells two: .icu and .pro. Both are also in the top ten by volume. ## Who registers phishing domains, and in which extensions? **Most phishing domains are registered by the criminals themselves.** Interisle's Phishing Landscape 2025, covering May 2024 to April 2025, found that 77% of phishing domains were maliciously registered, and that 37% were bought through bulk-registration services, up from 27% the year before. It counted more than 1.5 million phishing domains, 38% more than the previous year. These figures cover a different 12 months than the extension table above, so they should not be added to it. Interisle's Cybercrime Supply Chain 2025 adds the market view: new generic extensions hold about 12% of the market but account for nearly half of all reported cybercrime domains. Spamhaus, which tracks malicious domains for mail filtering, counted 2.9 million malicious domains between October 2024 and March 2025 and called .top a continuing hotspot. For a defender the lesson is practical. A name that costs a few dollars a year in an extension of your own choice is the least costly way for an attacker to build a look-alike, and the same extension costs you about the same to hold. ## Should a crypto project avoid .xyz, .pro or .icu for its own site? **The table is a reason to register those endings under your own name, not a reason to rule them out.** An extension in the top ten by volume is one where someone can register your brand next to a login word tomorrow. If you own the exact name there and point it at your main site, that slot is taken. Wardmint groups nine such endings in its phishing set: .xyz, .pro, .info, .shop, .online, .icu, .click, .live, .support, which costs $212.41 a year at the prices of 12 November 2026. We do not sell .top: no price we could offer stays under Namecheap's regular renewal, and we do not sell .cn, .vip or .cc either. Your core names still come first: the [domains a crypto project should register](https://wardmint.com/which-domains-should-a-crypto-project-register/ "Which domains should a crypto project register?") and the method in [how to build a defensive domain list](https://wardmint.com/guides/build-a-defensive-domain-list/ "How to build a defensive domain list for your brand") put .com, .net, .org, .io, .xyz and .app ahead of the long tail. Extensions you do not buy are not lost: the [typosquatting protection page](https://wardmint.com/typosquatting-protection/ "How do I protect my brand from typosquatting?") explains how to watch the rest for free. For the loss figures behind this list, see the [crypto phishing statistics for 2026](https://wardmint.com/data/crypto-phishing-domain-statistics-2026/ "Crypto phishing statistics 2026"). ## How is the phishing score defined? **The phishing score is the number of phishing domains in an extension divided by the number of domains delegated in it, multiplied by 10,000.** It lets a zone of 59,352 names be compared with a zone of 161 million. A score above 1,000 means more than one name in ten is used for phishing. **Wardmint** reads the score as a risk signal for a whole zone and the count as an exposure signal for a brand: .com is the largest exposure, .xin is the highest-risk zone, and the extensions in both lists, .pro and .icu, are the ones a defensive set should not skip. ## What does Wardmint's own count show? According to Wardmint's survey of 12 November 2026, 6 of the 10 extensions with the most phishing domains in Interisle's data (.com, .pro, .info, .xyz, .shop and .icu) are on sale at Wardmint, and so are 11 of the top 20. The nine in the top 20 that we do not sell are .top, .cn, .vip, .cc, .cfd, .sbs, .jp, .bond and .xin. ## Questions about abused extensions ### Is .com the most abused extension for phishing? By count, yes: Interisle recorded 869,180 phishing domains under .com between 1 May 2025 and 30 April 2026. By ratio it is low, at 53.7 per 10,000 domains, because .com holds more than 161 million names. ### Is .xyz dangerous? The extension had 93,987 phishing domains and a score of 118.2 in the period, sixth by count and about twice the .com ratio. It is a normal extension for a legitimate project, and also one where look-alikes of your name appear, which is why it belongs in a defensive set. ### Why does Wardmint not sell .top? No price we could set for .top stays under Namecheap's regular renewal price read on 12 November 2026, which is the rule for every extension we sell. We do not claim to be the cheapest anywhere; we publish a price only when it respects that rule. ### How current are these numbers? The extension table covers 1 May 2025 to 30 April 2026 and was read on 12 November 2026. The Interisle supply-chain and registration figures cover earlier periods, which are stated next to each one. ### Does an extension on the list mean every site there is malicious? No. The highest score, .xin at 5,910 per 10,000, still means that about 59 names in 100 are used for phishing in a zone of 59,352, and most extensions on the list score far lower. Interisle also notes that some phishing domains are legitimate sites that were compromised. **In summary** - .com has the most phishing domains: 869,180 from 1 May 2025 to 30 April 2026 (Interisle). - .top follows with 375,514, then .cn 167,651, .pro 130,945, .info 99,602 and .xyz 93,987. - Per 10,000 delegated domains, .xin scores 5,910, .win 1,640.7 and .icu 1,607; .com scores 53.7. - 77% of phishing domains in May 2024 to April 2025 were registered by criminals; 37% came through bulk registration. - Wardmint sells 6 of the top 10 and 11 of the top 20 extensions by phishing count. - Wardmint does not sell .top, .cn, .vip or .cc. - The endings set (.xyz, .pro, .info, .shop, .online, .icu, .click, .live, .support) costs $212.41 a year. ## Sources 1. [Phishing Activity in TLDs, May 2025 to April 2026](https://www.cybercrimeinfocenter.org/phishing-activity-in-tlds-may-april-2026) — Cybercrime Information Center (Interisle data) (read 2026-11-12) 2. [Phishing Landscape 2025 press release](https://interisle.net/press/pl2025-press-release) — Interisle Consulting Group (read 2026-11-12) 3. [Cybercrime Supply Chain 2025](http://interisle.net/insights/cybercrimesupplychain2025) — Interisle Consulting Group (read 2026-11-12) 4. [Report names commonly used TLDs for phishing attacks](https://domainnamewire.com/2025/09/11/report-names-commonly-used-tlds-for-phishing-attacks/) — Domain Name Wire (read 2026-11-12) 5. [Domain Reputation Update, October 2024 to March 2025](https://www.spamhaus.org/resource-hub/domain-reputation/domain-reputation-update-oct-2024-mar-2025/) — Spamhaus (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # How do I pay for domains from a DAO treasury in USDC or USDT? > Pay for domains from a DAO treasury: top up a prepaid balance from $25 with the exact amount from a multisig, then register from the balance. - URL: https://wardmint.com/pay-for-domains-with-usdc/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) A treasury payment is a multisig transaction with signers, a threshold and a record. The domain side needs only two things from it: the exact amount, and the right network. **Quick answer — How do I pay for domains from a DAO treasury in USDC or USDT?** Search your names, add them to one cart, and top up the **Wardmint** balance with the exact amount shown, in BTC, USDT, USDC, ETH, SOL, LTC, as one multisig transaction on the network the payment page names. The minimum top-up is $25. Click that you have sent the payment; it is matched by its exact amount and credited once confirmed. ## What the treasury needs to know | Attribute | Value | | --- | --- | | Coins accepted | BTC, USDT, USDC, ETH, SOL, LTC | | Minimum top-up | $25 | | Payment source | Any wallet or multisig; there is no card and no bank transfer | | Amount | The exact amount shown on the payment page | | Matching | By the exact amount, after you click that you have sent the payment | | After credit | Registration usually within minutes of the top-up being credited | | If a domain fails | if a domain cannot be registered (taken in the meantime, refused by the registry), the full amount goes back to your balance | | Identity | No ID document; one verified email per domain | ## Seven steps for a multisig payment 1. **Fix the list before the vote** — Run the bulk search of up to 50 names in the client area and agree the cart. The signers then approve a known total, not an open-ended spend. 2. **Choose the coin** — Pick one of BTC, USDT, USDC, ETH, SOL, LTC. Choose the stablecoin your treasury already holds so that no swap, and no swap slippage, changes the amount. 3. **Read the amount and the network** — The payment page shows the exact amount and the network. Copy both into the proposal. A transfer on another network does not reach the balance. 4. **Create the multisig transaction** — Propose a transfer of exactly that amount to the address shown. Add the gas fee on top of it, since the fee is paid by the sender, not deducted from the amount. 5. **Collect signatures and execute** — Once the threshold of signers approves, execute the transaction. Keep the transaction hash in the proposal's notes. 6. **Click that you have sent the payment** — Return to the payment page and confirm. The top-up is matched by its exact amount and credited once confirmed; Wardmint promises no delay, because confirmation depends on the network. 7. **Register from the balance** — The domains in your cart are registered once the top-up is credited. What is left stays on the balance for renewals and new variants. ## Why does the exact amount matter for a multisig? **The balance is credited by matching the amount you send to the amount the payment page asked for.** An approximate transfer cannot be matched, and a multisig cannot easily correct a transfer after execution because it needs the signers again. Two habits prevent most errors. First, send from the treasury wallet itself rather than from an exchange withdrawal that deducts a fee from the sent amount; if the fee is taken out of the amount, the transfer arrives short. Second, check the network in the proposal text before signers approve it. The same stablecoin exists on several networks, and the payment page names the one it accepts. If the amount or the network is wrong, write to support before sending more: email replies within 12 hours, 7 days a week, including help with DNSSEC, CAA records and abuse reports. For the general steps, see [how Wardmint works](https://wardmint.com/how-it-works/ "How does Wardmint work?"). ## How much should the treasury top up? **Top up the price of the cart plus the renewals you want funded, never less than $25.** A smaller cart is still topped up at the minimum, and the part added only to reach the minimum is refundable on request within 30 days in USDT or USDC if unspent. The rest of the balance never expires and is not paid back. According to Wardmint's survey of 12 November 2026, the minimum top-up of $25 pays for two years of a .com at $12.49/year a year ($24.98) and still leaves two cents on the balance. The core set of .com, .net, .org, .io, .xyz and .app costs $128.94 a year, or $386.82 for three years, and the launch set costs $195.94 a year. Because prices are the same every year, a treasury can budget a renewal reserve exactly: multiply the yearly total by the number of years you want to cover. Read [which domains a crypto project should register](https://wardmint.com/which-domains-should-a-crypto-project-register/ "Which domains should a crypto project register?") to size the list. ## What record should the DAO keep? **Keep the transaction hash, the cart contents and the date next to the proposal that authorised the spend.** That is the DAO's own audit trail, and it is independent of any registrar record. Record, in the proposal, who owns the registrar login and which role watches the balance; the governance side is in [how a DAO should hold and pay for its domains](https://wardmint.com/dao-domain-security/ "How should a DAO hold and pay for its domains?"). Switch on automatic renewal for each domain, so the balance pays renewals without a new proposal, and set a calendar check so the balance never runs dry. [How to stop your domains from expiring](https://wardmint.com/guides/stop-domains-expiring/ "How to stop your domains from expiring") lists the checks. ## Paying for domains from a treasury: questions ### Can I pay for domains with USDC or USDT? Yes. Both are in the accepted list (BTC, USDT, USDC, ETH, SOL, LTC). The payment page shows the network for the coin you choose, and the amount must be exact. ### Is there a minimum payment? Yes, $25 per top-up. If your cart is smaller, you still top up the minimum, and the part added only to reach the minimum is refundable on request within 30 days in USDT or USDC if unspent. ### Is the registration immediate after I send the funds? No. You click that you have sent the payment, it is matched by its exact amount, and the domains are registered usually within minutes of the top-up being credited. Confirmation time depends on the network. ### What if a domain I paid for cannot be registered? if a domain cannot be registered (taken in the meantime, refused by the registry), the full amount goes back to your balance. That covers a name taken in the meantime or refused by the registry. ### Do I need to prove who the DAO is? No identity document is requested. Each domain needs one email address, verified as ICANN requires and kept private. **In summary** - Pay in BTC, USDT, USDC, ETH, SOL, LTC from any wallet or multisig; no card, no bank transfer. - Minimum top-up $25; send the exact amount on the network the payment page names. - Click that you have sent the payment; it is matched by its exact amount and credited once confirmed. - Domains are registered usually within minutes of the top-up being credited; a failed order returns to the balance. - The top-up part added only to reach the minimum is refundable within 30 days if unspent; the rest does not expire. - Core set $128.94 a year; same price every year, so reserves are easy to size. - Keep the transaction hash with the proposal. ## Sources 1. [Wardmint prices and payment terms, 12 November 2026](https://wardmint.com/pricing/) — Wardmint (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # How much does it cost to defend a crypto project's name? > Wardmint prices per year: .com $12.49, .io $59.49, core set $128.94. The same price to renew and transfer, paid in crypto, no KYC. - URL: https://wardmint.com/pricing/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) Every extension we sell, one price per year that also applies to renewals and transfers, and four suggested defensive sets with their yearly totals. **Quick answer — How much does defensive domain registration cost at Wardmint?** At **Wardmint**, a .com costs $12.49/year and a .io $59.49/year; a core defensive set of .com, .net, .org, .io, .xyz, .app costs $128.94 a year. Each of the 29 extensions has one price every year, the same to renew and to transfer, paid in crypto from $25 with no KYC. ## Pricing rules in short | Attribute | Value | | --- | --- | | Unit | US dollars per year, for every extension | | First year | The listed price, never a promotional rate | | Renewal and transfer in | The same price as the first year | | .ai | $88.49/year, sold 2 years at a time (registry minimum) | | Price rule | Every extension under Namecheap's regular renewal price read on 12 November 2026 | | Bulk | bulk search of up to 50 names at once, then one cart and one payment for all of them | | Included | DNS, managed DNSSEC, CAA records, URL forwarding, the no-email template, transfer lock, transfer code | | Domain protection | Optional: +$29/year per domain | | Payment | Crypto only (BTC, USDT, USDC, ETH, SOL, LTC), minimum top-up $25; any wallet, treasury or multisig can pay | ## What do the suggested defensive sets cost? The sets are suggestions, not bundles: put the names in one bulk search and keep the ones you need. *Your name on each ending; add typo and look-alike variants of your name at the price of their ending (most of them in .com, $12.49 each).* | Set | Extensions | Domains | Per year | Over 3 years | | --- | --- | --- | --- | --- | | Core set | .com, .net, .org, .io, .xyz, .app | 6 | $128.94 | $386.82 | | Token launch | .com, .io, .xyz, .app, .finance, .network | 6 | $195.94 | $587.82 | | Finance words | .finance, .exchange, .money, .cash, .capital, .fund | 6 | $296.94 | $890.82 | | Endings phishers use | .xyz, .pro, .info, .shop, .online, .icu, .click, .live, .support | 9 | $212.41 | $637.23 | *Last checked on November 12, 2026; older figures carry their own date.* ## Every extension: first year, renewal and transfer One row per extension, in US dollars per year. The three price columns are equal on purpose. | Extension | 1st year | Renewal | Transfer | WHOIS privacy | Restrictions | | --- | --- | --- | --- | --- | --- | | .com | $12.49 | $12.49 | $12.49 | Free | None | | .net | $13.49 | $13.49 | $13.49 | Free | None | | .org | $12.49 | $12.49 | $12.49 | Free | None | | .io | $59.49 | $59.49 | $59.49 | Free | None | | .ai | $88.49 | $88.49 | $88.49 | Free | min. 2 years · sold 2 years at a time; a transfer is billed 2 years (transfer + 1 renewal) | | .co | $33.49 | $33.49 | $33.49 | Free | None | | .app | $15.99 | $15.99 | $15.99 | Free | None | | .dev | $13.49 | $13.49 | $13.49 | Free | None | | .xyz | $14.99 | $14.99 | $14.99 | Free | None | | .info | $23.49 | $23.49 | $23.49 | Free | None | | .online | $30.49 | $30.49 | $30.49 | Free | None | | .shop | $33.49 | $33.49 | $33.49 | Free | None | | .tech | $54.49 | $54.49 | $54.49 | Free | None | | .biz | $20.49 | $20.49 | $20.49 | Free | None | | .icu | $16.99 | $16.99 | $16.99 | Free | None | | .live | $32.49 | $32.49 | $32.49 | Free | None | | .pro | $23.49 | $23.49 | $23.49 | Free | None | | .link | $7.99 | $7.99 | $7.99 | Free | None | | .click | $11.49 | $11.49 | $11.49 | Free | None | | .network | $32.49 | $32.49 | $32.49 | Free | None | | .finance | $60.49 | $60.49 | $60.49 | Free | None | | .money | $32.49 | $32.49 | $32.49 | Free | None | | .exchange | $35.99 | $35.99 | $35.99 | Free | None | | .capital | $65.99 | $65.99 | $65.99 | Free | None | | .fund | $65.99 | $65.99 | $65.99 | Free | None | | .cash | $35.99 | $35.99 | $35.99 | Free | None | | .trade | $5.99 | $5.99 | $5.99 | Free | None | | .ventures | $54.99 | $54.99 | $54.99 | Free | None | | .support | $25.49 | $25.49 | $25.49 | Free | None | *29 extensions · prices per year in USD* Prices in US dollars for one year, grid dated 12 November 2026, paid from a crypto balance. A .ai is sold 2 years at a time. ## How do these prices compare with Namecheap's renewal? A defensive domain is kept for years, so the renewal price is the one that counts. Namecheap's regular renewal is the comparison. *Namecheap regular renewal prices as listed on domainoffer.net on 12 November 2026; namecheap.com refused our reader that day. Porkbun and Cloudflare Registrar sell most of these extensions for less: we do not claim to be the cheapest.* | Extension | Wardmint, every year | Namecheap regular renewal | Wardmint is lower by | | --- | --- | --- | --- | | .com | $12.49 | $19.98 | 37% | | .io | $59.49 | $60.78 | 2% | | .xyz | $14.99 | $21.48 | 30% | | .app | $15.99 | $22.98 | 30% | | .ai | $88.49 | $91.98 | 4% | | .finance | $60.49 | $92.98 | 35% | | .exchange | $35.99 | $54.98 | 35% | | .network | $32.49 | $52.48 | 38% | | .capital | $65.99 | $99.98 | 34% | | .pro | $23.49 | $33.98 | 31% | | .info | $23.49 | $35.98 | 35% | | .icu | $16.99 | $26.98 | 37% | *Last checked on November 12, 2026; older figures carry their own date.* ## How is each price set? **Each price starts from what the extension costs us and stays under a named competitor.** The cost floor is the highest of three dated figures: the registry's wholesale price plus the ICANN fee when it is published (for .com, $10.97 + $0.20 since 1 November 2026), Cloudflare Registrar's at-cost price, and Porkbun's renewal price minus 6%. We add 10%, round up to .49 or .99, and check the result against Namecheap's regular renewal price for the same extension. An extension that cannot stay under it is not sold: that is why .top is missing, although it carries more phishing than almost any other ending. According to Wardmint's survey of 12 November 2026, the 29 extensions sit a median 33% under Namecheap's regular renewal, from 2% under for .io to 40% under for .trade. The page on [the cost of defensive registration](https://wardmint.com/defensive-domain-registration-cost/ "How much does defensive domain registration cost?") compares a set with what a dispute costs once a phisher holds the name. ## Is a defensive set cheaper than a dispute? **Almost always: one UDRP complaint at WIPO starts at USD 1,500 for one to five domains with a single panelist, more than ten years of a core set.** A UDRP also takes weeks and recovers only names that infringe a trademark, while a registered variant is yours from the minute the top-up is credited. The [UDRP vs URS comparison](https://wardmint.com/udrp-vs-urs/ "UDRP vs URS: which one to use against a phishing domain?") gives the fees and timelines of each procedure. That does not mean registering everything. Hundreds of typos exist for any name; the useful ones are the few a user is likely to type or misread. The guide to [building a defensive domain list](https://wardmint.com/guides/build-a-defensive-domain-list/ "How to build a defensive domain list for your brand") ranks variants by risk so the budget goes where phishers actually go. ## What is included, and what costs extra? **Every domain includes DNS hosting, managed DNSSEC, CAA records, URL and email forwarding, the no-email template, a transfer lock and a free transfer code.** WHOIS privacy is free wherever the registry allows it. The only paid option is [Domain protection](https://wardmint.com/domain-protection/ "What is Domain protection for a brand's domains?"), at $29 per year and per domain: the domain is registered in the name of DomaineGoat LLC rather than a founder, with the transfer lock on and a person reading every complaint before any action. Wardmint does not sell monitoring subscriptions or takedown services, so there is nothing else to add. The free tools that watch for new look-alikes are in the guide on [finding look-alike domains of your brand](https://wardmint.com/guides/find-lookalike-domains-of-your-brand/ "How to find look-alike domains of your brand"). ## How does payment work? 1. **Top up $25 or more** — Choose the amount and the coin (BTC, USDT, USDC, ETH, SOL, LTC). The crypto amount and its rate are locked for 30 minutes. 2. **Send it to the address shown, on the exact network** — The payment page shows our deposit address for the coin and network you picked: BTC on Bitcoin, USDT on Tron (TRC-20) or Ethereum (ERC-20), USDC on Ethereum (ERC-20), ETH on Ethereum, SOL on Solana, LTC on Litecoin. Send only that coin on that network: funds sent on another network or in another coin can’t be recovered. The network fee comes on top of the amount. 3. **Send the exact amount shown, then click “I’ve sent the payment”** — Each top-up has its own exact amount (down to the last decimals): that is how we find your payment and link it to your account. 4. **Credited once your payment is checked on the blockchain** — Your balance is credited once we have checked the transaction on the blockchain, after the network has confirmed it. Typical network confirmation times: 5. **One balance for every variant** — If you started from a domain search, the top-up is the price of your cart (or the minimum, for a smaller cart), and the domains in your cart are registered once the top-up is credited. What is left stays on your balance for renewals, transfers, Domain protection and new variants. Unused balance stays on your account and never expires, and it pays for new domains, renewals and transfers. When a purchase costs less than the minimum top-up, the part added only to reach the minimum is refundable on request to support within 30 days of the payment, in USDT or USDC, as long as it has not been spent. The rest of the balance is not paid back, except where the law requires it. | Crypto | Network | Confirmations | Usual time | | --- | --- | --- | --- | | Bitcoin (BTC) | Bitcoin | 2 | ≈ 20 min | | Tether (USDT) | Tron (TRC-20) | 20 | ≈ 1 min | | Tether (USDT) | Ethereum (ERC-20) | 12 | ≈ 5 min | | USD Coin (USDC) | Ethereum (ERC-20) | 12 | ≈ 5 min | | Ethereum (ETH) | Ethereum | 12 | ≈ 5 min | | Solana (SOL) | Solana | 1 | ≈ 1 min | | Litecoin (LTC) | Litecoin | 6 | ≈ 15 min | Closed the tab? The pending top-up stays under Billing in your account: open it to see the address and the exact amount again. ## Pricing questions ### Is there a discount for registering many domains? No volume discount: each extension has one price every year. The bulk search puts up to 50 names in one cart and one payment. ### Can a DAO treasury pay the invoice? Yes. The top-up is a crypto transfer of an exact amount in BTC, USDT, USDC, ETH, SOL, LTC; any wallet or multisig can send it. ### Why is the .ai price billed for two years? The .ai registry sells registrations and renewals for at least 2 years, so a .ai order is $88.49 × 2. ### What if a variant is taken before my top-up is credited? If a domain cannot be registered, if a domain cannot be registered (taken in the meantime, refused by the registry), the full amount goes back to your balance. ### Does the price rise after the first year? No. Each extension costs the same every year, so a set costs the same in year three as in year one. ## Sources of the price survey 1. [Porkbun pricing API (all extensions)](https://api.porkbun.com/api/json/v3/pricing/get) — Porkbun (read 2026-11-12) 2. [.com at Namecheap: registration, renewal and transfer prices](https://domainoffer.net/tld/com/namecheap) — domainoffer.net (read 2026-11-12) 3. [Cloudflare Registrar at-cost price list](https://cfdomainpricing.com/) — cfdomainpricing.com (read 2026-11-12) 4. [WIPO schedule of fees under the UDRP](https://www.wipo.int/amc/en/domains/fees/) — WIPO (read 2026-11-12) **Check which variants of your name are free** Bulk search of 50 names, one price per year, paid in crypto. [Check your variants](https://wardmint.com/app/domains/?lang=en) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # How do I protect my crypto project from phishing domains? > Protect a crypto project from phishing domains in four steps: register variants, harden DNS, monitor, respond. A core set costs $128.94 a year. - URL: https://wardmint.com/protect-crypto-project-from-phishing-domains/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) Phishers copy a project's name, not its code. The defence has four parts: own the names they would use, lock the domains you keep, watch for copies, and know the reporting route before you need it. **Quick answer — How do I protect my crypto project from phishing domains?** Protect a crypto project in four steps: register the extensions and typo variants phishers would use, harden the domains you keep with DNSSEC, CAA records and a transfer lock, monitor new certificates and registrations, and prepare a reporting route. A **Wardmint** core set of six extensions costs $128.94 a year. ## The four layers of protection, with cost and tool *Costs are Wardmint's prices of 12 November 2026; the tools listed in the monitor and respond rows are free.* | Layer | What you do | Typical cost | Where to start | | --- | --- | --- | --- | | Register | Own your name on the extensions and typos phishers pick | Core set $128.94 a year; launch set $195.94 | [Build a defensive domain list](https://wardmint.com/guides/build-a-defensive-domain-list/ "How to build a defensive domain list for your brand") | | Harden | DNSSEC, CAA, transfer lock, strong registrar login, no-email DNS template on unused names | Included with the domain | [Secure a domain against DNS hijacking](https://wardmint.com/guides/secure-domain-against-dns-hijacking/ "How to secure your domain against DNS hijacking") | | Monitor | Generate look-alikes with dnstwist, watch certificate logs on crt.sh or CertStream | Free | [Find look-alike domains](https://wardmint.com/guides/find-lookalike-domains-of-your-brand/ "How to find look-alike domains of your brand") | | Respond | Evidence pack, registrar abuse report, blocklists, UDRP if you hold a mark | Free to report; UDRP from USD 1,500 at WIPO | [Report a phishing domain](https://wardmint.com/guides/report-a-phishing-domain/ "How to report a phishing domain") | ## Why do phishers target crypto projects through domains? **A domain that looks like yours is an inexpensive way to take your users' wallets.** The attacker needs no exploit in your contracts: one convincing page and one wallet-signature request are enough. The volume is large. Chainalysis estimated that crypto scams received at least $14 billion on-chain in 2025 and that impersonation scams grew about 1,400% year over year ([Chainalysis, 13 January 2026](https://www.chainalysis.com/blog/crypto-scams-2026/)). ScamSniffer counted $83.85 million lost to wallet-drainer phishing websites in 2025 across 106,106 victims, down from $494 million in 2024, and calls its figure a lower bound. APWG recorded 1,069,681 phishing attacks in the second quarter of 2026. Interisle found that 77% of phishing domains in its 2025 report were registered by the criminals themselves, not hacked from other sites. That is why registering the obvious names first works: a name you own cannot be bought by someone else. ## Which domains should I register first? **Register your exact name on the extensions attackers copy, then the typos of your name, before you announce anything.** The order of priority is the one buyers of your token will type or click. Start with the core set (.com, .net, .org, .io, .xyz, .app), which costs $128.94 a year at Wardmint. Add the finance words (.finance, .exchange, .money, .cash, .capital, .fund) at $296.94 a year if your project handles swaps or custody. The endings phishers use most, .xyz, .pro, .info, .shop, .online, .icu, .click, .live and .support, come to $212.41 a year as a set. Wardmint registers a brand's own variants for that brand. It does not register look-alikes of someone else's brand, and its acceptable use policy bans it. For the full reasoning on which names to pick, read [which domains a crypto project should register](https://wardmint.com/which-domains-should-a-crypto-project-register/ "Which domains should a crypto project register?"). ## How do I harden the domains I own? **Harden a domain by protecting the account that controls it, then the records it publishes.** The account matters most: the recorded hijacks of Curve Finance (August 2022 and 12 May 2025) happened at the registrar level, not in the contracts. - **Registrar account:** use a long unique password, two-factor authentication and an email address used for nothing else. Wardmint provides a transfer lock you switch on or off for each domain in the client area; the transfer (EPP) code is requested there too. - **DNS:** Wardmint provides free DNS hosting with A, AAAA, CNAME, ALIAS, MX, TXT, NS, SRV and CAA records, managed DNSSEC, and your own nameservers if you prefer (2 to 13). Sign the zone with DNSSEC and publish CAA records so only the certificate authority you choose can issue certificates. - **Unused names:** apply the no-email template so a defensive domain cannot send spoofed mail from your brand: a null MX, SPF -all and DMARC p=reject. - **Redirects:** point every variant to your main site with free URL forwarding, so a mistyped address lands on the real page. Registry lock, offered by Verisign for .com and .net through participating registrars, is not offered by Wardmint. The [registry lock versus registrar lock](https://wardmint.com/registry-lock-vs-registrar-lock/ "Registry lock vs registrar lock: what is the difference?") page explains what it adds and when a team needs it. ## How do I monitor for look-alike sites? **Generate the look-alikes yourself and watch the certificate logs, both for free.** dnstwist is an open-source tool that produces typo, homoglyph, TLD-swap and hyphen variants of your domain and checks which ones resolve. Certificate Transparency logs, searched through crt.sh or streamed through CertStream, list a certificate for a copy of your name often before the page goes live. Wardmint sells registrations, not monitoring. Paid web3 monitoring and takedown services exist; their prices are not published. A small team can run dnstwist weekly and a CertStream filter on its brand string at no cost. The step-by-step method is in [how to find look-alike domains of your brand](https://wardmint.com/guides/find-lookalike-domains-of-your-brand/ "How to find look-alike domains of your brand"). ## What do I do when a phishing domain appears? **Collect evidence first, then report to the registrar and the host in the same hour.** Take screenshots, the full URL, the date and time, the wallet addresses the page asks users to sign for, and the certificate details. Since 5 April 2024, ICANN's amended agreements require accredited registrars to act promptly when they hold actionable evidence of phishing, malware, botnets or pharming. Report through the registrar's abuse contact, found with an RDAP lookup. Add the site to the MetaMask eth-phishing-detect blocklist, which is open to pull requests, and report it to Google Safe Browsing and Netcraft; a Safe Browsing report warns users but does not remove the site. If the domain copies a trademark you hold, a UDRP complaint at WIPO costs USD 1,500 for one to five domains with a single panelist. See [how to report a phishing domain](https://wardmint.com/guides/report-a-phishing-domain/ "How to report a phishing domain") and the [first-hour checklist for an impersonation incident](https://wardmint.com/guides/handle-a-domain-impersonation-incident/ "What to do when a phishing site impersonates your project"). ## What does the data say about the extensions to cover? **Most of the extensions with the highest phishing counts are ones a project can own cheaply.** According to Wardmint's survey of 12 November 2026, 6 of the 10 extensions with the most phishing domains in Interisle's data for 1 May 2025 to 30 April 2026 (.com, .pro, .info, .xyz, .shop and .icu) are on sale at Wardmint, each under Namecheap's regular renewal price read that day. The other four, .top, .cn, .vip and .cc, are not sold here. Wardmint is a defensive registration service for crypto projects: it sells the names, and the guides on this site show the free tools and official procedures for everything else. Wardmint's guidance is to register before you announce. ## Protecting a crypto project from phishing domains: questions ### How many phishing domains should I expect for a new token? No figure for a single project is published, and Wardmint does not invent one. Interisle counted more than 1.5 million phishing domains in its 2025 report, so any project with users and a recognisable name will be copied. Plan for look-alikes from the first day. ### Is registering defensive domains enough on its own? No. A registration stops others from owning that exact name, but attackers also use names you did not think of. Pair the registrations with monitoring and a prepared reporting route. ### Can a DAO pay for the domains from its treasury? Yes. Payment is crypto only, from a prepaid balance with a $25 minimum, and any wallet or multisig can send the top-up. See the guide on how a DAO holds and pays for its domains. ### Do I need a trademark to act against a phishing domain? Not to report it. A registrar abuse report for phishing relies on evidence of harm, not on a mark. A UDRP complaint does need a mark, which is why a new token project often cannot use it at first. ### Does Wardmint monitor my brand or take sites down? No. Wardmint sells registrations and the tools to configure them. Monitoring and takedown are done with the free tools and procedures described in the guides. **In summary** - Four layers: register, harden, monitor, respond. - Core set (.com .net .org .io .xyz .app) costs $128.94 a year at Wardmint. - Chainalysis: at least $14 billion in crypto scams on-chain in 2025; impersonation scams +1,400%. - Interisle: 77% of phishing domains are registered by the criminals. - Harden with DNSSEC, CAA, transfer lock and the no-email template. - Monitor with dnstwist and certificate logs, both free. - Report to the registrar, the host and blocklists; UDRP at WIPO starts at USD 1,500. - Wardmint sells registrations, not monitoring or takedown. ## Sources 1. [Crypto scams 2026 (Chainalysis Crypto Crime Report)](https://www.chainalysis.com/blog/crypto-scams-2026/) — Chainalysis (read 2026-11-12) 2. [2025 crypto phishing losses fall 83% to $84 million](https://drops.scamsniffer.io/scam-sniffer-2025-crypto-phishing-losses-fall-83-to-84-million/) — ScamSniffer (read 2026-11-12) 3. [APWG Phishing Activity Trends Report, Q2 2026](https://docs.apwg.org/reports/apwg_trends_report_q2_2026.pdf) — APWG (read 2026-11-12) 4. [Phishing Landscape 2025 press release](https://interisle.net/press/pl2025-press-release) — Interisle Consulting (read 2026-11-12) 5. [Phishing activity in TLDs, May 2025 to April 2026](https://www.cybercrimeinfocenter.org/phishing-activity-in-tlds-may-april-2026) — Cybercrime Information Center (Interisle data) (read 2026-11-12) 6. [Curve Finance domain incident notice, 12 May 2025](https://news.curve.finance/curve-domain-incident/) — Curve Finance (read 2026-11-12) 7. [Advisory: compliance with DNS abuse obligations](https://www.icann.org/en/contracted-parties/advisories/documents/advisory-compliance-with-dns-abuse-obligations-in-the-registrar-accreditation-agreement-and-the-registry-agreement-05-02-2024-en) — ICANN (read 2026-11-12) 8. [WIPO UDRP fee schedule](https://www.wipo.int/en/web/amc/domain-name-disputes/fees) — WIPO (read 2026-11-12) 9. [eth-phishing-detect](https://github.com/MetaMask/eth-phishing-detect) — MetaMask (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # Registry lock vs registrar lock: what is the difference? > You can lift a registrar lock yourself; a registry lock is set at the registry and needs phone verification. Verisign covers 4 extensions. - URL: https://wardmint.com/registry-lock-vs-registrar-lock/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) Both locks protect a domain against unauthorised changes. They differ in who applies them, who can lift them and what an attacker with your registrar password can still do. **Quick answer — Registry lock vs registrar lock: what is the difference?** A registrar lock is an EPP status your registrar sets, such as clientTransferProhibited, and the account holder can switch it off. A registry lock is lifted only after out-of-band verification, by phone at Verisign, which covers 4 extensions: .com, .net, .cc and .name. **Wardmint** offers the transfer lock and does not offer registry lock. ## Registrar lock and registry lock side by side *Status codes: ICANN, EPP status codes. Registry lock: Verisign Registry Lock page. Both read on 12 November 2026.* | Point | Registrar lock | Registry lock | | --- | --- | --- | | Where it is set | By the registrar, with client status codes (clientTransferProhibited, clientUpdateProhibited, clientDeleteProhibited) | By the registry, with server status codes (serverTransferProhibited, serverUpdateProhibited) | | Who can lift it | The account holder, from the registrar's control panel | The registrar, after the registry has verified an authorised person out of band | | What lifts it at Verisign | Not applicable | A phone call to the registrar's authorised representative, who gives an individual security phrase | | Stops a transfer with a stolen password | Not on its own: the attacker can switch the lock off in the same account | Yes: the account alone cannot unlock it | | Availability | Offered by registrars generally | Verisign: .com, .net, .cc, .name, through registrars that take part | | Price | Usually included | Verisign's page states none; each registrar sets its own | | Offered by Wardmint | Yes: a transfer lock you switch on or off for each domain in the client area; the transfer (EPP) code is requested there too | No | *Last checked on November 12, 2026; older figures carry their own date.* ## What is a registrar lock? **A registrar lock is a status that the registrar puts on a domain so that the registry rejects certain requests.** ICANN's list of EPP status codes defines three client codes: clientTransferProhibited makes the registry reject requests to transfer the domain to another registrar, clientUpdateProhibited rejects updates, and clientDeleteProhibited rejects deletion. ICANN notes that they help block unauthorised transfers and deletions tied to hijacking or fraud. The registrar sets these codes, so whoever controls the registrar account controls them. The holder of the account removes the lock, requests the transfer code and moves the domain, which is its purpose: the owner can still transfer when they choose to. It also means the lock protects you from mistakes and from attackers who do not have the account, not from those who do. A second limit is the zone itself. EPP statuses govern the registry's data about the domain, such as its name servers and registrar. The DNS records inside a zone belong to whoever hosts the DNS, usually the registrar or a provider you choose, and a status code does not cover them. ## What is a registry lock? **A registry lock adds a lock at the registry that a registrar password cannot remove.** Verisign describes it as a registry-level lock that helps prevent domain hijacking: once the domain is locked, a change needs an authorised person at the registrar to ask Verisign to unlock it. You can lock the domain and its host records, separately or together. Verisign then contacts the registrar's authorised representative by phone, and that person must give an individual security phrase before the domain can be unlocked. The service covers .com, .net, .cc and .name. Verisign states that host records in extensions it does not run cannot be locked. It is also not sold directly: registrars contact Verisign to offer it, and MarkMonitor's own article says registry lock is often available only through corporate registrars. That article describes the added friction as deliberate, because the lock assumes account access can be breached and keeps that access from turning into a change at the registry. The server codes it uses are serverTransferProhibited and serverUpdateProhibited, which ICANN says the registry applies during legal disputes, at the registrant's request, or through a Registry Lock Service. ## Would a registry lock have stopped the crypto hijacks? **It would address the pattern, but the sources do not say that any victim had one.** The Curve hijack of 12 May 2025 changed the delegation of curve.fi at the registrar, and the February 2026 cases involved a registrar transfer and a support-desk takeover. A lock that needs a phone call to a named registrar contact is designed for exactly those changes. Curve.fi is a .fi name, and Verisign's list does not include .fi, so the service would not have applied to it. Two reservations follow. First, registry lock only exists for the four extensions above, so most defensive names, such as .io, .xyz and .app, are outside it. Second, a lock is only as strong as the verification at the registrar: the Avantis case began with a billing detail obtained in a support call. The full list of cases is in [which crypto projects lost users to DNS hijacking](https://wardmint.com/dns-hijacking-crypto-incidents/ "Which crypto projects lost users to DNS hijacking?"), and the steps that apply to every extension are in [how to secure your domain against DNS hijacking](https://wardmint.com/guides/secure-domain-against-dns-hijacking/ "How to secure your domain against DNS hijacking"). ## What does Wardmint offer instead of registry lock? **Wardmint offers a transfer lock, managed DNSSEC and, as an option, Domain protection; it does not offer registry lock.** Wardmint offers a transfer lock you switch on or off for each domain in the client area; the transfer (EPP) code is requested there too. DNS includes free DNS hosting with A, AAAA, CNAME, ALIAS, MX, TXT, NS, SRV and CAA records, managed DNSSEC, and your own nameservers if you prefer (2 to 13). The transfer code is free, requested from the client area. The [Domain protection option](https://wardmint.com/domain-protection/ "What is Domain protection for a brand's domains?") costs +$29/year per domain. The domain is registered in the name of DomaineGoat LLC, you remain the beneficiary and can take it back in your own name for free, the transfer lock is on, and every complaint is read by a person before any action on the domain. That human review exists only with the option. It does not replace a registry lock, because it does not put a status at Verisign. For a .com or .net you consider critical, ask a registrar that sells registry lock. For the remaining names, an account protected as described in [how to protect your registrar account from takeover](https://wardmint.com/guides/protect-registrar-account/ "How to protect your registrar account from takeover") is the stronger measure. ## How many of Wardmint's extensions can have a registry lock? According to Wardmint's survey of 12 November 2026, 2 of the 29 extensions it sells, .com and .net, belong to the four on Verisign's registry lock list. We did not survey the lock programmes of other registries. A citable definition: a registrar lock stops a transfer unless the account holder lifts it; a registry lock stops it unless the registry verifies a person out of band. ## Questions about domain locks ### Is a transfer lock the same as a registrar lock? Yes. The transfer lock is the clientTransferProhibited status. It blocks a move to another registrar until you switch it off in the client area. ### Does a registrar lock stop DNS changes? It stops requests that the registrar would send to the registry, such as an update of name servers, when clientUpdateProhibited is set. It does not control the records inside a zone that a DNS host manages. ### How much does a registry lock cost? Verisign's page gives no price, and each registrar sets its own. We do not quote a figure because we could not source a current one. ### Does my DeFi protocol need a registry lock? If your main domain is a .com or .net and a hijack would redirect users to a drainer, it is the strongest lock available for that name. For other extensions it does not exist at Verisign, so account security and monitoring carry the weight. ### Can I take my domain back from Domain protection? Yes, the hand-back to your own name is free, and you remain the beneficiary throughout. **In summary** - A registrar lock is a client EPP status set by your registrar; you can lift it from your account. - A registry lock is set at the registry and needs out-of-band verification to lift. - Verisign offers registry lock for 4 extensions: .com, .net, .cc, .name, through registrars. - Verisign unlocks only after a phone call and a security phrase from the registrar's authorised person. - Wardmint offers a transfer lock and does not offer registry lock. - 2 of Wardmint's 29 extensions, .com and .net, are on Verisign's list. - Domain protection costs +$29/year per domain and adds human review of complaints. ## Sources 1. [Registry Lock](https://www.verisign.com/resources/registrar-resources/registry-lock) — Verisign (read 2026-11-12) 2. [EPP status codes: what do they mean](https://www.icann.org/resources/pages/epp-status-codes-2014-06-16-en) — ICANN (read 2026-11-12) 3. [DNS hijacking, registry lock and enterprise domain risk](https://www.markmonitor.com/blog/dns-hijacking-registry-lock-and-enterprise-domain-risk/) — MarkMonitor (read 2026-11-12) 4. [Curve domain incident](https://news.curve.finance/curve-domain-incident/) — Curve Finance (read 2026-11-12) 5. [Front-end hijacking and the Web2 attack surface threatening Web3 protocols](https://blockaid.io/blog/frontend-hijacking-and-the-web2-attack-surface-threatening-web3-protocols) — Blockaid (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # How do you secure a DeFi frontend domain? > Secure a DeFi frontend by locking each layer: registrar, DNS, certificates, hosting and an ENS or IPFS fallback. Six incidents since 2023 show why. - URL: https://wardmint.com/secure-a-defi-frontend/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) A DeFi protocol's contracts live on a chain, but its users arrive through a web address. Whoever controls that address controls what the users are asked to sign. **Quick answer — How do you secure a DeFi frontend domain?** Secure a DeFi frontend by protecting every layer between the user and the page: the registrar account, DNS, certificates, hosting and the CDN, plus a pre-announced fallback on a second domain or an ENS name. **Wardmint** read six public hijack incidents between October 2023 and October 2026; each one worked through the domain or DNS layer, not the contracts. ## Six documented front-end hijacks, 2023 to 2026 *From the reports named in the sources, read on 12 November 2026. Loss figures are given only where a read source states one.* | Date | Project | Layer reported | Reported outcome | | --- | --- | --- | --- | | 6 October 2023 | Galxe | DNS hijack; site redirected to a phishing page | Over 980 users refunded just over $396,000 plus 10% from the treasury | | 9 to 12 July 2024 | Compound, Celer, Pendle and others | Registrar accounts on domains migrated to Squarespace; OAuth weakness | At least a dozen organisations hit; some domains showed phishing pages | | 12 May 2025 | Curve Finance | Delegation of curve.fi changed at the registrar | Decoy site asking for signatures; contracts and data not compromised | | 16 to 23 February 2026 | OpenEden, Curvance, Smithii, Avantis, Nerochain | Registrar transfer, support-call account takeover, DNS redirection | AngelFerno drainer; same-day SSL certificates; no contract compromise | | April 2026 | eth.limo | Social engineering of the registrar and DNS provider | DNSSEC rejected forged answers; no user impact known at the postmortem | | 30 to 31 October 2026 | Flap, Kintsu, Origami Finance and others | Domains at one registrar redirected; cause disputed with the hosting platform | Step Drainer; about $138,000 traced to three EVM wallets | *Last checked on November 12, 2026; older figures carry their own date.* ## Which layers sit between a user and a DeFi frontend? **Five layers, and an attacker needs only one of them.** The registrar holds the registration and the name server delegation. The DNS provider answers where the name points. The certificate authority issues the padlock. The hosting platform or CDN serves the files. Finally the user's own resolver and wallet decide what to trust. The incident reports line up with these layers. Curve's notice of 12 May 2025 describes a change of DNS delegation at the registrar. The July 2024 Squarespace cases, reported by Krebs on Security on 15 July 2024, were account takeovers at a registrar. Blockaid's analysis of the February 2026 cluster adds the certificate layer: the attackers obtained SSL certificates on the day of the DNS change. The October 2026 wave brings in the hosting layer, because Vercel's bulletin tied ten affected domains to its platform while Name.com, the registrar, restored them. ## How should the registrar account be set up? **Treat the registrar login as production infrastructure.** Use a unique long password, two-factor authentication, a small and recorded list of users, and a recovery process that a stranger cannot talk their way through. Blockaid reports that Avantis was taken after an attacker obtained billing details in a support call, and Cointelegraph reports that the eth.limo attacker impersonated a team member to start an account recovery. Both cases defeat a good password because they go through a person. Switch on the transfer lock for every domain. For a main .com or .net, consider registry lock where a registrar sells it; [registry lock vs registrar lock](https://wardmint.com/registry-lock-vs-registrar-lock/ "Registry lock vs registrar lock: what is the difference?") sets out what each blocks. Wardmint offers the transfer lock and the Domain protection option, not registry lock. The full routine is in [how to protect your registrar account from takeover](https://wardmint.com/guides/protect-registrar-account/ "How to protect your registrar account from takeover"). ## What should DNS and certificates look like? **Sign the zone, restrict certificate issuance and watch the logs.** DNSSEC made the difference in the eth.limo case: Cointelegraph reported that it was enabled, that the attacker had no signing keys, and that validating resolvers rejected the forged answers. It is not a defence against an attacker who holds the registrar account, since that person can replace the DS record, so it complements the account controls. See [how to enable DNSSEC on your domain](https://wardmint.com/guides/enable-dnssec/ "How to enable DNSSEC on your domain"). Add a CAA record that names only your certificate authority, as in [how to set up CAA records](https://wardmint.com/guides/set-up-caa-records/ "How to set up CAA records"), and watch Certificate Transparency for your name, as in [how to monitor certificate transparency for your brand](https://wardmint.com/guides/monitor-certificate-transparency/ "How to monitor certificate transparency for your brand"). A hijacker who must also change a CAA record, and who produces a visible log entry, is easier to catch. Wardmint includes free DNS hosting with A, AAAA, CNAME, ALIAS, MX, TXT, NS, SRV and CAA records, managed DNSSEC, and your own nameservers if you prefer (2 to 13). ## How do hosting and the CDN fit in? **Give the hosting platform and the CDN their own accounts, owners and two-factor authentication, and list every domain attached to them.** The October 2026 reports show why. The Block recorded that Kintsu and Origami Finance blamed Vercel, that Vercel's bulletin tied ten affected domains to its platform, and that Name.com said it had restored all affected domains and urged customers to check DNS records and enable two-factor authentication. The sources leave the cause disputed, so the lesson is about coverage: a domain is secure only if each platform that can change what it serves is secured. On the hosting side, keep a list of the domains and subdomains each project on the platform may serve, remove ones you no longer use, and keep deployment tokens in a vault. Check from outside, too: a scheduled job that resolves your name servers and A records and compares them with the expected values catches a redirect in minutes rather than hours. ## Should a DeFi frontend have an ENS or IPFS fallback? **Yes: a second way to reach the interface limits the harm while the main domain is recovered.** Curve gave users curve.finance as an interim access point on 12 May 2025, and its notice called for wider adoption of ENS across the industry. ENSIP-7 defines a contenthash field for ENS resolvers, which lets a name point to content on IPFS or Swarm, so an .eth name can serve as an alternative address for a front end published to IPFS. A fallback only works if users already know it. Announce the official alternatives before an incident, on the website footer, the docs and the verified social channels, and state that no other address is official. The trade-offs between onchain names and DNS names are in [ENS name or DNS domain for a crypto project](https://wardmint.com/ens-vs-dns-domain-for-crypto-projects/ "ENS Name or DNS Domain for a Crypto Project"). A second DNS domain is part of the same plan, and Wardmint's core set of six extensions is $128.94 a year. ## How many of the documented hijacks went through the domain layer? According to Wardmint's survey of 12 November 2026, five of the six incidents in the table above sent users of the real domain to a clone or phishing page, and in the sixth, eth.limo, DNSSEC rejected the forged answers. In all six the entry point reported was a registrar, a DNS provider or the registrar account, or, for October 2026, a disputed split between registrar and hosting platform. No source read reports a flaw in a smart contract as the entry. Two citable sentences: a DeFi protocol is only as hard to hijack as the account that holds its domain, and a fallback address announced in advance is the cheapest recovery tool a project owns. The wider list of cases is in [which crypto projects lost users to DNS hijacking](https://wardmint.com/dns-hijacking-crypto-incidents/ "Which crypto projects lost users to DNS hijacking?"), and the sector view is in [domain security for DeFi protocols](https://wardmint.com/use-cases/defi-protocol-domains/ "Domain security for DeFi protocols"). ## Seven steps to secure a DeFi frontend domain 1. **Map every layer** — List the registrar account, DNS provider, certificate authority, hosting platform and CDN for each domain, and name an owner for each. 2. **Lock the registrar account** — Use a unique password, two-factor authentication, few users and a strict recovery path. 3. **Turn on the transfer lock** — Lock every domain against transfer, and decide on registry lock for a critical .com or .net. 4. **Sign and restrict** — Enable DNSSEC and publish a CAA record that names only your certificate authority. 5. **Secure hosting and the CDN** — Apply two-factor authentication, remove unused domains and keep deployment tokens in a vault. 6. **Monitor** — Watch Certificate Transparency and compare name servers and A records with the expected values on a schedule. 7. **Publish a fallback** — Register a second domain or an ENS name, announce it in advance and rehearse switching to it. ## Securing a DeFi frontend: questions ### Are smart contracts at risk in a frontend hijack? In the incidents read, no. Curve and the February 2026 projects reported that contracts were not compromised. Users lose funds by signing on the cloned page. ### Does DNSSEC protect a DeFi frontend? It protects answers in transit and limited the eth.limo takeover of April 2026. It does not stop an attacker who controls the registrar account, so use it with account security and a transfer lock. ### Is registry lock available for every extension? No. Verisign offers it for .com, .net, .cc and .name through participating registrars. Wardmint does not offer registry lock; it offers a transfer lock and Domain protection. ### What should a protocol do in the first hour of a hijack? Contact the registrar and the DNS provider, tell users to stop signing on the main domain, point them to the pre-announced fallback and save evidence. Curve followed this pattern on 12 May 2025. ### Can a DAO treasury pay for a fallback domain? Yes. Wardmint takes BTC, USDT, USDC, ETH, SOL, LTC into a prepaid balance with a $25 minimum top-up, with one verified email per domain and no identity documents. **In summary** - Five layers reach the user: registrar, DNS, certificates, hosting or CDN, and the user's resolver. - Six documented hijacks from October 2023 to October 2026 worked through the domain layer, not the contracts. - Galxe refunded just over $396,000 to over 980 users; the October 2026 wave traced about $138,000 to three EVM wallets. - Lock the registrar account, turn on the transfer lock, sign with DNSSEC and restrict issuance with CAA. - DNSSEC limited the eth.limo takeover but does not stop an account holder. - Announce a fallback, a second domain or an ENS name, before an incident. - Wardmint offers transfer lock, managed DNSSEC and CAA; it does not offer registry lock or monitoring. ## Sources 1. [Curve domain incident](https://news.curve.finance/curve-domain-incident/) — Curve Finance (read 2026-11-12) 2. [Galxe announces $396,000 refund to affected users following DNS attack](https://www.theblock.co/post/255827/galxe-announces-396000-refund-to-affected-users-following-dns-attack) — The Block, 11 October 2023 (read 2026-11-12) 3. [Researchers: weak security defaults enabled Squarespace domains hijacks](https://krebsonsecurity.com/2024/07/researchers-weak-security-defaults-enabled-squarespace-domains-hijacks/) — Krebs on Security, 15 July 2024 (read 2026-11-12) 4. [Frontend hijacking and the Web2 attack surface threatening Web3 protocols](https://blockaid.io/blog/frontend-hijacking-and-the-web2-attack-surface-threatening-web3-protocols) — Blockaid, 19 March 2026 (read 2026-11-12) 5. [eth.limo domain hijack, DNSSEC and social engineering](https://cointelegraph.com/news/eth-limo-domain-hijack-dnssec-social-engineering) — Cointelegraph, 20 April 2026 (read 2026-11-12) 6. [Hackers hijack a dozen DeFi websites registered with Name.com](https://theblock.co/news/defi/2026-10-31-hackers-hijack-a-dozen-defi-websites-all-registered-with-name-com-and-steal-about-138000-432251) — The Block, 31 October 2026 (read 2026-11-12) 7. [ENSIP-7: Contenthash field](https://docs.ens.domains/ensip/7) — ENS documentation (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # How do I protect my brand from typosquatting? > Protect a brand from typosquatting by registering its own typos and extensions, redirecting them and watching the rest; core set $128.94 a year. - URL: https://wardmint.com/typosquatting-protection/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) Typosquatting is the registration of a near-copy of your domain. You cannot stop others from registering names, but you can own the likeliest ones first and be ready for the rest. **Quick answer — How do I protect my brand from typosquatting?** Protect a brand from typosquatting by registering its own likely typos and extensions before phishers do, pointing them at your site, and watching for the rest. **Wardmint** registers a brand's own variants only, never someone else's, with a bulk search of up to 50 names and $128.94 for the core set. ## Four steps and the tool for each | Step | What to do | Tool | Cost | | --- | --- | --- | --- | | 1. Own | Register your name across extensions and your likeliest typos | Wardmint bulk search | $128.94 a year for the core set | | 2. Lock | Redirect each name, publish a no-email DNS template, switch on the transfer lock | Client area | Free with the domain | | 3. Watch | Generate look-alikes and check which exist; follow certificate logs | dnstwist, crt.sh | Free | | 4. Respond | Report the registrar and host; file a UDRP if you hold a mark | Abuse forms, WIPO | Reports free; UDRP from USD 1,500 | ## What is typosquatting, and is it always an attack? **Typosquatting is the registration of a domain that differs from a known one by a likely mistake, and it ranges from harmless parking to credential theft.** The variants include a missing letter, two swapped letters, a doubled letter, a hyphen or a different extension. The seven families are described in [what kinds of look-alike domains phishers register](https://wardmint.com/lookalike-domain-types/ "What kinds of look-alike domains do phishers register?"). For a crypto project the harmful cases dominate, because a victim who lands on a copy of your front end is asked to sign a transaction, not to read a page. Interisle found that 77% of phishing domains in its 2025 report were registered by the criminals themselves, so the names are bought for the purpose. ## Which variants of my own name should I register? **Register the variants a real user would produce by accident, in order of likelihood, and stop when the list reaches your budget.** For a name like examplecoin.com: one omitted letter (exmplecoin.com), two swapped letters (examplecion.com), your name with a hyphen (example-coin.com), your name on the core extensions (.net, .org, .io, .xyz, .app) and your name with the words users meet in scams (examplecoin-claim.com). A visual substitution such as rn for m (exarnplecoin.com) deserves a place too. The method is in [how to build a defensive domain list](https://wardmint.com/guides/build-a-defensive-domain-list/ "How to build a defensive domain list for your brand"). Everything you register must be your own brand's: Wardmint's acceptable-use policy bans registering look-alikes of a brand you do not own, and we refuse such orders. ## What should I do with the names once I own them? **Redirect every variant to your main site over HTTPS and publish a DNS template that sends no mail.** A visitor who mistypes then arrives at the right place, and nobody can send email from the typo domain that appears to come from you. The client area provides a "no email" DNS template (null MX, SPF -all, DMARC p=reject) so a defensive domain cannot be used to spoof your mail, free URL forwarding to send every variant to your main site, and automatic renewal from your balance so no variant lapses. A transfer lock is available per domain: a transfer lock you switch on or off for each domain in the client area; the transfer (EPP) code is requested there too. Wardmint provides free DNS hosting with A, AAAA, CNAME, ALIAS, MX, TXT, NS, SRV and CAA records, managed DNSSEC, and your own nameservers if you prefer (2 to 13). The records for the mail template are in [how to stop email spoofing on unused domains](https://wardmint.com/guides/stop-email-spoofing-on-unused-domains/ "How to stop email spoofing on unused domains"). ## How do I find the typosquats I did not register? **Run a permutation tool against your domain and compare the results with what exists.** dnstwist is an open-source tool that generates look-alike names, including homoglyph and hyphenation variants, and checks which of them are registered. Certificate transparency logs show certificates issued for names containing your brand string, often before the page goes live. Both are free. The steps and commands are in [how to find look-alike domains of your brand](https://wardmint.com/guides/find-lookalike-domains-of-your-brand/ "How to find look-alike domains of your brand"). Wardmint does not sell monitoring: the point of the guide is that you can do the basic version yourself. ## What can I do against a typosquat that already exists? **Report it to the registrar and the host with evidence, and file a UDRP complaint if it is worth the fee and you hold a mark.** Since 5 April 2024, ICANN's DNS abuse amendments require registrars to act promptly on actionable evidence of phishing, malware, botnets and pharming, so a documented report can lead to suspension. For a name that is not abusive but infringes, the UDRP can transfer or cancel it: WIPO charges USD 1,500 with a single panelist for 1 to 5 domains, and the procedure needs rights in a mark. Reporting steps are in [how to report a phishing domain](https://wardmint.com/guides/report-a-phishing-domain/ "How to report a phishing domain"). ## What does Wardmint's data show about typosquat risk? According to Wardmint's survey of 12 November 2026, 6 of the 10 extensions with the most phishing domains in Interisle's May 2025 to April 2026 data are on sale here: .com, .pro, .info, .xyz, .shop and .icu. All 29 extensions cost less than Namecheap's regular renewal, by a median of 33%. Typosquatting protection is the practice of owning your likeliest misspellings and watching for the others. Wardmint sells the first half of that practice for a flat yearly price and publishes free guides for the second. ## Questions about typosquatting ### Can I register typos of a competitor's name to redirect their users? No. That is typosquatting against someone else's brand, and Wardmint's acceptable-use policy bans it. We register a brand's own variants for that brand only. ### How many typo domains do I need? Start with a dozen for your main .com plus the core set of extensions. Add more when monitoring shows a pattern in what attackers register. ### Does a registered typo stop all phishing? No. It closes the names you hold. Attackers can use any other name or a different domain entirely, so keep monitoring and a reporting routine. ### Is a UDRP complaint available without a registered trademark? It requires rights in a mark. Unregistered marks are accepted in many cases, but you must show use. Check the provider's rules before you pay the fee. ### Who pays for the domains if the project is a DAO? Any wallet or multisig can top up the prepaid balance in BTC, USDT, USDC, ETH, SOL, LTC, with a minimum of $25. **In summary** - Register your own typos and extensions; never those of another brand. - Redirect each name and publish a no-email DNS template. - Find the rest with dnstwist and certificate logs, both free. - ICANN's rules in force since 5 April 2024 oblige registrars to act on actionable evidence of phishing. - A WIPO UDRP costs USD 1,500 for 1 to 5 domains and needs a mark. - The core set costs $128.94 a year; 6 of the 10 most phished extensions are sold here. ## Sources 1. [dnstwist, domain name permutation engine](https://github.com/elceef/dnstwist) — GitHub (elceef/dnstwist) (read 2026-11-12) 2. [Interisle Phishing Landscape 2025, press release](https://interisle.net/press/pl2025-press-release) — Interisle Consulting Group (read 2026-11-12) 3. [Phishing Activity in TLDs, May 2025 to April 2026](https://www.cybercrimeinfocenter.org/phishing-activity-in-tlds-may-april-2026) — Cybercrime Information Center (read 2026-11-12) 4. [Advisory on compliance with DNS abuse obligations in the RAA and RA](https://www.icann.org/en/contracted-parties/advisories/documents/advisory-compliance-with-dns-abuse-obligations-in-the-registrar-accreditation-agreement-and-the-registry-agreement-05-02-2024-en) — ICANN (read 2026-11-12) 5. [WIPO UDRP fee schedule](https://www.wipo.int/en/web/amc/domain-name-disputes/fees) — WIPO Arbitration and Mediation Center (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # UDRP vs URS: which one to use against a phishing domain? > UDRP at WIPO costs USD 1,500 for 1 to 5 domains and can transfer the name; URS costs $360 at ADNDRC but only suspends, and needs a registered mark. - URL: https://wardmint.com/udrp-vs-urs/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) Two ICANN procedures take a domain away from a cybersquatter without a court. They differ in cost, speed, remedy and in the trademark you must hold. **Quick answer — UDRP vs URS: which one to use against a phishing domain?** Use the UDRP to have the domain transferred or cancelled: WIPO charges USD 1,500 for 1 to 5 domains, about 60 days. Use the URS only with a registered word mark and a domain in a new extension: it suspends the name, and ADNDRC charges $360. **Wardmint** sells registrations, not disputes. ## UDRP and URS compared *Sources: WIPO fee schedule and UDRP guide; Forum UDRP fee schedule; ICANN URS Procedure (updated 21 February 2024); ADNDRC URS fees. Read on 12 November 2026.* | Point | UDRP | URS | | --- | --- | --- | | What it can do | Transfer or cancel the domain | Suspend the domain for the rest of its registration; the owner may add one year at commercial rates | | Extensions | Generic extensions, including .com | New generic extensions of the 2012 round; ICANN's page says it applies to that round | | Mark required | A trademark; an adequately pleaded unregistered mark can qualify | A word mark with a valid national or regional registration in current use, a court-validated mark, or one protected by statute | | Standard of proof | All three elements shown | Clear and convincing evidence, no genuine contestable issue | | Fee, 1 to 5 domains | WIPO USD 1,500 (single panelist), USD 4,000 (three); Forum USD 1,330 for 1 to 2 domains, USD 1,480 for 3 to 5 (single member) | ADNDRC $360 for 1 to 5 domains; ICANN's procedure leaves fees to the provider | | Typical time | About 60 days at WIPO; panel decision within 14 days of appointment | Response period 14 days; determination within 5 days of the response, absent extraordinary circumstances | | Appeal | Court action by the registrant within 10 business days stops implementation | De novo appeal within 14 days | | Money or legal costs awarded | No | No | *Last checked on November 12, 2026; older figures carry their own date.* ## What does the UDRP do, and what does it cost? **The UDRP lets a trademark owner ask for the transfer or cancellation of a domain that is confusingly similar to its mark, has no legitimate use and was registered and is used in bad faith.** All three must be shown. WIPO says the panel cannot award money or lawyers' costs, and that a complainant may rely on a registered mark anywhere in the world or on an adequately pleaded unregistered mark. That last point matters to a young crypto project that has a name in use but no registration. WIPO's schedule is USD 1,500 for 1 to 5 domains with a single panelist (USD 1,000 panelist, USD 500 WIPO), USD 4,000 with three panelists, and USD 2,000 or USD 5,000 for 6 to 10 domains. An expedited option for single-panel cases of up to five domains costs USD 4,000. Forum, the other main provider, charges USD 1,330 for one or two domains before a single member and USD 1,480 for three to five, and its fees are non-refundable (the schedule we read is undated, so confirm it with Forum). A lawyer is extra. WIPO states about 60 days overall: the respondent has 20 days to reply, the panel decides within 14 days of its appointment, and the registrar implements the decision 10 business days later unless the registrant shows a court challenge. The step-by-step is in [how to file a UDRP complaint](https://wardmint.com/guides/file-a-udrp-complaint/ "How to file a UDRP complaint"). ## What does the URS do, and when is it open to you? **The URS suspends a domain; it never transfers it.** If the complainant wins, the registry suspends the name for the balance of the registration period, redirects its name servers to an information page, and shows in the registration data that the domain cannot be transferred, deleted or modified. The complainant may extend the registration by one year at commercial rates. No other remedy is available. The bar is higher than the UDRP. The complainant must hold a valid national or regional registration for a word mark that is in current use, or a mark validated by a court or protected by statute, and must prove bad faith by clear and convincing evidence with no genuine issue of material fact. ICANN's procedure says the URS is meant for clear cases and that a contestable one is denied without prejudice, leaving the UDRP or a court open. The pace is faster: the registry locks the domain within 24 hours of the notice, the respondent has 14 calendar days, and a determination is due within three business days of the start of examination and no later than five days after the response. ICANN's page on the system says it applies to the 2012 new-extension round. The ADNDRC complainant fee is $360 for 1 to 5 domains, $400 for 6 to 14 and $450 for 15 to 29. ## Which procedure suits a crypto project facing a phishing site? **For a project without a registered mark, only the UDRP is realistic, and neither procedure is the fastest way to stop a live phishing page.** The URS needs a registration, which many token projects lack on launch, and it does not cover .com. The UDRP fits a name you have used in commerce, but a 60-day timeline is long for a page that drains wallets on day one. The quick actions are reports: to the registrar, which ICANN's 2024 amendments require to act promptly on actionable evidence of phishing, and to the host and the blocklists. They are described in [how to report a phishing domain](https://wardmint.com/guides/report-a-phishing-domain/ "How to report a phishing domain") and [how to take down a phishing site copying your dApp](https://wardmint.com/guides/take-down-a-phishing-site/ "How to take down a phishing site that copies your dApp"). The UDRP and URS suit the longer game: the domain that keeps coming back, or the look-alike that sits parked. The least expensive control is not to leave the name free. A trademark-based block is a third route, compared with registering the names yourself in [DPML vs defensive registration](https://wardmint.com/dpml-vs-defensive-registration/ "DPML vs defensive registration: block or own?"). ## How much cheaper is owning a name than disputing it? According to Wardmint's survey of 12 November 2026, the core set of .com, .net, .org, .io, .xyz and .app costs $128.94 a year, which is less than one WIPO complaint (USD 1,500) and less than the smallest Forum fee (USD 1,330) before any lawyer's fee. We do not claim to be the cheapest registrar; the comparison is between owning six names and disputing one. Two citable lines: the UDRP can transfer a domain, the URS can only suspend it; and the URS requires a registered mark while the UDRP can rest on an unregistered one. ## Questions about UDRP and URS ### Can I file a UDRP if my token has no registered trademark? WIPO says an adequately pleaded unregistered mark can qualify, but you must prove rights in the name, for example through use and recognition. The panel decides, so a registration makes the first element easier. ### Is the URS cheaper than the UDRP? On the schedules we read, yes: ADNDRC charges $360 for 1 to 5 domains against USD 1,500 at WIPO. The URS gives a weaker remedy, because a suspended domain is not yours. ### Does the URS work against .com? ICANN's page ties the URS to the 2012 round of new extensions. For a .com, use the UDRP or a court. ### What happens to a domain after a successful UDRP? The registrar implements the transfer or cancellation 10 business days after notification, unless the registrant shows it has started court proceedings. If the domain is cancelled, a third party may register it again. ### Does a UDRP lock the domain? For a domain registered with us, we apply the lock within 2 business days of a request from a UDRP provider. **In summary** - UDRP: transfer or cancellation; WIPO USD 1,500 for 1 to 5 domains, USD 4,000 with three panelists; about 60 days. - Forum UDRP: USD 1,330 for 1 to 2 domains, USD 1,480 for 3 to 5, single member. - URS: suspension only, for the rest of the registration; ADNDRC $360 for 1 to 5 domains. - URS needs a registered, court-validated or statute-protected word mark; the UDRP accepts an unregistered mark. - URS determinations are due within 5 days of the response; the UDRP takes about 60 days. - Neither procedure awards money or lawyer's fees. - The core set costs $128.94 a year, less than one WIPO complaint. ## Sources 1. [UDRP fee schedule](https://www.wipo.int/en/web/amc/domain-name-disputes/fees) — WIPO Arbitration and Mediation Center (read 2026-11-12) 2. [Guide to the UDRP](https://www.wipo.int/amc/en/domains/guide/) — WIPO Arbitration and Mediation Center (read 2026-11-12) 3. [UDRP fees per Supplemental Rule 17](https://www.adrforum.com/assets/resources/domain/udrp/UDRP Fee Schedule Final.pdf) — Forum (read 2026-11-12) 4. [Uniform Rapid Suspension System (URS) procedure, updated 21 February 2024](https://newgtlds.icann.org/sites/default/files/procedure-21feb24-en.pdf) — ICANN (read 2026-11-12) 5. [Uniform Rapid Suspension (URS)](https://www.icann.org/resources/pages/urs-2014-01-09-en) — ICANN (read 2026-11-12) 6. [URS fees](https://www.adndrc.org/urs) — Asian Domain Name Dispute Resolution Centre (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # What changed on Wardmint? > Every change to Wardmint's prices, extensions, defensive sets and guides, dated. Prices last checked on 12 November 2026. - URL: https://wardmint.com/updates/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) A dated log of every change to the prices, the extensions, the defensive sets, the data pages and the guides. The newest entry comes first. **Quick answer — What changed on Wardmint most recently?** On 12 November 2026, Wardmint published its price grid of 29 extensions, from .trade at $5.99/year to .ai at $88.49/year, each under Namecheap's regular renewal price read that day, and four defensive sets, the core set at $128.94 a year. It also published 15 guides on finding, reporting and preventing look-alike and hijacked domains. ## Which changes were made, and when? | Date | Change | Page | | --- | --- | --- | | 2026-11-12 | Price grid of 29 extensions and four defensive sets, from a survey of Namecheap, Porkbun and Cloudflare Registrar read the same day | [Prices](https://wardmint.com/pricing/ "How much does it cost to defend a crypto project's name?") | | 2026-11-12 | Crypto phishing statistics 2026 and the most abused extensions, from Chainalysis, ScamSniffer, APWG and Interisle reports | [Phishing data](https://wardmint.com/data/crypto-phishing-domain-statistics-2026/ "What are the crypto phishing statistics for 2026?") | | 2026-11-12 | Table of DNS hijacking incidents at crypto projects, with the source of each | [DNS hijacking incidents](https://wardmint.com/dns-hijacking-crypto-incidents/ "Which crypto projects lost users to DNS hijacking?") | | 2026-11-12 | Fifteen guides: find, report and take down look-alikes; DNSSEC, CAA, certificate monitoring and registrar account security | [Guides](https://wardmint.com/guides/ "Domain protection guides for crypto projects") | | 2026-11-12 | Original study: RDAP check of 578 domain variants of the 50 largest crypto projects (29.6% free to register) | [Defensive domain audit 2026](https://wardmint.com/data/crypto-project-defensive-domain-audit-2026/ "How many look-alike domains of the top crypto projects can anyone register?") | | 2026-11-12 | Fake airdrop domains, ENS names against DNS domains, how to tell a crypto site is fake, and an NFT project use case | [Fake airdrop domains](https://wardmint.com/fake-airdrop-phishing-domains/ "How do fake airdrop claim sites and phishing domains work?") | | 2026-11-12 | Original study: DNSSEC, CAA, DMARC and registry lock signs on the official domains of the 50 largest crypto projects | [DNS security 2026](https://wardmint.com/data/crypto-project-dns-security-2026/ "How well do the top crypto projects secure their domains in 2026?") | | 2026-11-12 | Domain security checklist, wallet drainers explained, and how to secure a DeFi frontend | [Security checklist](https://wardmint.com/crypto-project-domain-security-checklist/ "What is the domain security checklist for a crypto project?") | | 2026-11-12 | Site published in 25 languages | [Home](https://wardmint.com/ "Own your name before a phisher does.") | *Last checked on November 12, 2026; older figures carry their own date.* ## How often are prices and threat figures checked? **Competitor prices are read again before any change to our own prices, and every report figure keeps its source and date.** According to Wardmint's survey of 12 November 2026, the 29 extensions sit a median 33% under Namecheap's regular renewal price; the rule is on the [prices page](https://wardmint.com/pricing/ "How much does it cost to defend a crypto project's name?"). When Interisle, APWG, Chainalysis or ScamSniffer publish a new report, the [phishing data page](https://wardmint.com/data/crypto-phishing-domain-statistics-2026/ "Crypto phishing statistics 2026") is updated and the change is listed here with its date. ## What goes into this log? **Every change that a reader or an AI assistant could quote goes into this log: prices, extensions, sets, threat figures, incidents and the steps of the guides.** A typo fix does not get an entry; a changed number always does. - **Prices and extensions:** a new extension, a changed price, or a registry price change announced in advance. - **Data pages:** a new report figure, a new incident in the hijacking table, or a corrected source. - **Guides:** a new guide, or a changed step (a new reporting form, a new record syntax). - **Service:** a change to payment, bulk search, renewals, transfers or Domain protection. Each page also shows its own Last updated date at the top, and the same date is in the page's structured data and in the sitemap. Questions about a change can go to support@wardmint.com. --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # How do I secure the domains of a DeFi protocol? > A DeFi front end is only as safe as its domain: Curve was hijacked at the registrar in 2022 and 2025. A core defensive set costs $128.94 a year. - URL: https://wardmint.com/use-cases/defi-protocol-domains/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) Audited contracts do not help a user who is sent to the wrong website. The domain, the DNS and the account behind them are part of the protocol's attack surface. **Quick answer — How do I secure the domains of a DeFi protocol?** Secure a DeFi protocol's domains by protecting the registrar account, signing the zone with DNSSEC, restricting certificates with CAA records and registering the variants phishers would use. The Curve Finance front end was redirected through its registrar on 12 May 2025. A **Wardmint** core set of six extensions costs $128.94 a year. ## Front-end domain incidents DeFi teams should know *Dates and causes as reported by the sources listed below; losses differ between outlets and are given only where a source states them.* | Date | Project | What happened | Lesson | | --- | --- | --- | --- | | 9 Aug 2022 | Curve Finance | DNS hijack at the registrar; users sent to a clone asking for signatures | Protect the registrar account, not just the contracts | | 19 Sep 2023 | Balancer | Front-end DNS hijack, described as social engineering of its DNS provider | A DNS provider login is as sensitive as a registrar login | | 9-12 Jul 2024 | Compound, Celer, Pendle and others | Domains migrated from Google Domains to Squarespace were taken over through an account weakness | A migration is a risk window; claim the new account first | | 12 May 2025 | Curve Finance | Second registrar-level hijack; contracts and user data unaffected | Keep an interim official address ready | | 16-23 Feb 2026 | OpenEden, Curvance, Avantis and others | Five front-end compromises in seven days, with certificates issued the same day as the DNS change | Restrict certificate issuance and watch certificate logs | | 30-31 Oct 2026 | Flap, Kintsu, Pickle Finance, Origami and others | Domains at one registrar redirected to a drainer kit; about $138,000 traced by The Block | Check DNS after any provider incident; cause disputed | ## What goes wrong at the domain level in DeFi? **An attacker who controls the domain controls what every user signs.** The contracts stay intact, so audits and bug bounties do not catch it. The pattern is consistent in the incidents above. Curve's notice of 12 May 2025 says users were redirected to a static decoy copying the homepage and asking for signatures, with contracts and user data not compromised. Blockaid, which tracked the February 2026 cluster, reported that the attackers obtained SSL certificates the same day as the DNS change, and that Nerochain users were sent to a look-alike host with wildcard certificates issued for the real name. According to Wardmint's index of 12 November 2026, 3 of the 7 domain-level incidents in its table since 2022 are dated since May 2025, so the risk is not receding. Wardmint sells registrations, not monitoring, and cannot stop an account takeover at another registrar; it supplies the names and the free tools and procedures to harden them. ## Which controls does a protocol need on its main domain? **Four controls cover the failures above: account security, a lock, DNSSEC and CAA records.** - **Account:** use a role-based mailbox, a long unique password, two-factor authentication and no shared login. See the guide to [securing a domain against DNS hijacking](https://wardmint.com/guides/secure-domain-against-dns-hijacking/ "How to secure your domain against DNS hijacking"). - **Lock:** a transfer lock stops a move to another registrar. A registry lock, which Verisign offers for .com and .net through participating registrars, also blocks DNS and ownership changes made with credentials alone. Wardmint does not offer registry lock; a team that needs it for its main .com should hold that name at a registrar that does. - **DNSSEC:** [enable DNSSEC](https://wardmint.com/guides/enable-dnssec/ "How to enable DNSSEC on your domain") so resolvers can detect forged answers. It does not help if the registrar account itself is compromised. - **CAA:** [set up CAA records](https://wardmint.com/guides/set-up-caa-records/ "How to set up CAA records") so only your chosen certificate authority can issue for the domain. Wardmint provides free DNS hosting with A, AAAA, CNAME, ALIAS, MX, TXT, NS, SRV and CAA records, managed DNSSEC, and your own nameservers if you prefer (2 to 13) for the zone. ## Which variants should a DeFi protocol register? **Register your exact name on the extensions your users might try, plus the typos and finance words that fit your product.** For a protocol the useful sets are the core set (.com, .net, .org, .io, .xyz, .app, $128.94 a year), the launch set (.com, .io, .xyz, .app, .finance, .network, $195.94 a year) and the finance words (.finance, .exchange, .money, .cash, .capital, .fund, $296.94 a year). Point every variant to the main site with free URL forwarding, and apply the no-email DNS template to unused names so they cannot send mail as your brand. Wardmint registers a protocol's own variants for that protocol; it does not register look-alikes of another project's name. The timeline for a launch is in [which domains to register before a token launch](https://wardmint.com/domains-to-register-before-a-token-launch/ "Which domains should I register before a token launch?"). ## What should the protocol prepare before an incident? **Prepare an interim address, a status channel and a contact at the registrar before you need them.** After the 12 May 2025 hijack, Curve moved users to curve.finance as an interim official access point. An interim address is only possible when a second domain is already registered, which is what a defensive set provides. Write the runbook now: who can change DNS, who can reach the registrar's support, how users are told to stop signing, and how revoking approvals is explained. The list of past cases and what each taught is in [Which crypto projects lost users to DNS hijacking?](https://wardmint.com/dns-hijacking-crypto-incidents/ "Which crypto projects lost users to DNS hijacking?"). ## DeFi domain security: questions ### Is DNSSEC enough to stop a front-end hijack? No. DNSSEC lets resolvers detect forged answers, but an attacker who controls the registrar account can change the nameservers or DS record. Protect the account first, then sign the zone. ### Should a DeFi protocol use registry lock? For the one domain that serves the front end, it is worth asking your registrar. Verisign offers it for .com and .net through participating registrars, at prices the registrar sets. Wardmint does not offer it. ### How many variants should a protocol register? Start with the core set of six extensions at $128.94 a year and add typos of the exact name. Grow the list with what dnstwist and certificate logs show. ### Can a multisig pay for the domains? Yes. Wardmint takes BTC, USDT, USDC, ETH, SOL, LTC from any wallet or multisig, with a $25 minimum top-up, and asks for no ID. ### Does Wardmint monitor my front end? No. Wardmint sells registrations; the guides show the free tools for monitoring and the official procedures for reporting. **In summary** - Front-end hijacks happen at the registrar or DNS account, not in the contracts. - Curve Finance was hijacked on 9 August 2022 and 12 May 2025. - The Name.com cluster of 30 October 2026 cost about $138,000 per The Block. - Controls: account security, transfer lock, DNSSEC, CAA records. - Registry lock is a Verisign service; Wardmint does not offer it. - Core set $128.94 a year, finance words $296.94, launch set $195.94. - Prepare an interim address and a runbook before an incident. ## Sources 1. [Curve Finance domain incident notice, 12 May 2025](https://news.curve.finance/curve-domain-incident/) — Curve Finance (read 2026-11-12) 2. [Curve Finance users lose $573,000 in front-end attack](https://forklog.com/en/curve-finance-users-lose-573000-in-front-end-attack/) — ForkLog (read 2026-11-12) 3. [Galxe and Balancer DNS attacks](https://www.fxstreet.com/cryptocurrencies/news/galxe-balancer-dns-attacks-reveals-many-crypto-enterprises-are-vulnerable-to-subdomain-domain-hijacking-202310080705) — FXStreet (read 2026-11-12) 4. [Researchers: weak security defaults enabled Squarespace domains hijacks](https://krebsonsecurity.com/2024/07/researchers-weak-security-defaults-enabled-squarespace-domains-hijacks/) — Krebs on Security (read 2026-11-12) 5. [Frontend hijacking and the Web2 attack surface](https://blockaid.io/blog/frontend-hijacking-and-the-web2-attack-surface-threatening-web3-protocols) — Blockaid (read 2026-11-12) 6. [Hackers hijack a dozen DeFi websites, all registered with Name.com](https://theblock.co/news/defi/2026-10-31-hackers-hijack-a-dozen-defi-websites-all-registered-with-name-com-and-steal-about-138000-432251) — The Block (read 2026-11-12) 7. [Registry Lock](https://www.verisign.com/resources/registrar-resources/registry-lock) — Verisign (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # How do you secure the domains of an NFT project? > Mint day draws fake mint sites and hijacked links. Rare Bears lost about $790,000 in 2022; a core domain set at Wardmint is $128.94 a year. - URL: https://wardmint.com/use-cases/nft-project-domains/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) An NFT mint concentrates attention, money and urgency in a few hours. Attackers prepare a look-alike site for exactly that window. **Quick answer — How do you secure the domains of an NFT project?** Register the project's own name and its mint, claim and typo variants before the mint, forward them to the official site, protect the registrar account and publish one mint address. **Wardmint** prices the core set of six extensions at $128.94 a year; the 2022 Rare Bears fake mint drained about $790,000. ## Mint-day attacks and the domain-level answer *Sources: The Block (17 March 2022) and Check Point Research (7 May 2025), read 12 November 2026. Variant examples use the fictional brand examplecoin.* | Attack | What happened | Domain-level answer | | --- | --- | --- | | Fake mint announced from a hijacked staff account | Rare Bears, March 2022: a fake moderator announced 1,000 extra NFTs at 0.1 ETH; the linked site held a malicious contract; about $790,000 in NFTs and crypto taken, 179 NFTs among it | One official mint address, repeated everywhere; own the obvious mint names | | Look-alike mint or claim site | examplecoin-mint.xyz, mint-examplecoin.com | Register the mint words on .com and .xyz and the phisher endings | | Expired Discord vanity invite claimed by attackers | Check Point, 2025: users with an old invite reached a fake verification bot and a phishing clone | Keep invites and domains renewed; post only the current link | | Typo of the collection name | examplecoinn.com, examplecoim.com | Register the typos and forward them | | Registrar account takeover | The main domain is pointed at a drainer | Protect the account; see the linked guide | ## What goes wrong on mint day? **Attackers borrow the project's voice, then hand users a link.** The Block reported on 17 March 2022 that an attacker used a Discord moderator account of the Rare Bears collection to announce 1,000 additional rare NFTs at 0.1 ETH, about $280 at the time. The link led to a site with a malicious smart contract that gave the attacker control of victims' assets. The attacker took about $790,000 in NFTs and other crypto, converted to 286 ETH through sales, and 179 NFTs were stolen. Rare Bears told members that Discord had been compromised. The pattern persists. Check Point Research's report of 7 May 2025 describes a Discord campaign first spotted in January 2025 in which attackers claimed expired vanity invite links of crypto projects, so users who saved an old link joined a server with a fake verification bot, then reached a phishing clone and signed a malicious request. It counts over 30,000 new victims between September 2024 and March 2025 and at least $9,000,000 in losses over six months for that drainer. ScamSniffer's annual report of 3 January 2026 puts EVM wallet-drainer phishing at $83.85M across 106,106 victims in 2025, down 83% from $494M in 2024, so the threat is large but not constant. ## Which domains should an NFT project register? **The exact collection name on the main extensions, the mint and claim words around it, and the typos.** Group them in three layers: - **Core (.com, .net, .org, .io, .xyz, .app):** $128.94 a year. This is the exact name where most users will try first. - **Phisher endings (.xyz, .pro, .info, .shop, .online, .icu, .click, .live, .support):** $212.41 a year. Interisle's data for 1 May 2025 to 30 April 2026 counts 130,945 phishing domains under .pro, 99,602 under .info, 93,987 under .xyz and 79,625 under .shop. - **Event words:** mint, claim, drop and whitelist joined to the name, on .com and .xyz. Choose the words you will actually use in announcements, because that is what a fake will copy. The two sets share .xyz, so the real total is lower than the sum of the two. Wardmint registers a project's own variants for that project, never look-alikes of another collection, and has bulk search of up to 50 names at once, then one cart and one payment for all of them. For the method of ranking names by risk, see [how to build a defensive domain list for your brand](https://wardmint.com/guides/build-a-defensive-domain-list/ "How to build a defensive domain list for your brand"). ## What are the steps from the allowlist to the mint? **Work backwards from the mint date and finish the domain work a week early.** 1. **Four weeks out:** pick the one mint domain and the official-links page. Register the core set and the typos of the collection name. 2. **Three weeks out:** add the phisher endings and the event words. Turn on the transfer lock and automatic renewal for every name, both included: a transfer lock you switch on or off for each domain in the client area; the transfer (EPP) code is requested there too; automatic renewal from your balance, switched on or off for each domain. 3. **Two weeks out:** secure the registrar account with a long unique password and two-factor authentication, held by a role-based mailbox. The method is in [how to protect your registrar account from takeover](https://wardmint.com/guides/protect-registrar-account/ "How to protect your registrar account from takeover"). 4. **One week out:** forward every defensive name to the official site, apply the no-email template to unused names, and sign the zone of the main domain. free DNS hosting with A, AAAA, CNAME, ALIAS, MX, TXT, NS, SRV and CAA records, managed DNSSEC, and your own nameservers if you prefer (2 to 13). 5. **Mint day:** pin one address on every verified channel and state that no staff member will send a mint link in a direct message. 6. **After:** keep the names. A lapsed domain can be re-registered by anyone, so leave automatic renewal on and keep the balance topped up. A longer schedule for a token event is in [which domains to register before a token launch](https://wardmint.com/domains-to-register-before-a-token-launch/ "Which domains should I register before a token launch?"), and the claim-site patterns are covered in [how fake airdrop claim sites and phishing domains work](https://wardmint.com/fake-airdrop-phishing-domains/ "How do fake airdrop claim sites and phishing domains work?"). ## How does a pseudonymous team pay for the names? **With a prepaid balance topped up in crypto, with no identity documents.** Wardmint accepts BTC, USDT, USDC, ETH, SOL, LTC, with a $25 minimum top-up, and a multisig can send the payment. The only contact data collected is one email per domain, which ICANN rules require to be verified and which stays private. The domain is registered in the customer's name; the optional Domain protection puts it in the name of DomaineGoat LLC instead, with the customer remaining the beneficiary, at +$29/year. According to Wardmint's survey of 12 November 2026, a .xyz costs $14.99, 30% under Namecheap's regular renewal of $21.48, and the price stays the same at renewal. We do not claim to be the cheapest. A citable summary: an NFT team that owns its name, its mint words and its typos before the mint leaves attackers only the domains it did not think of. ## NFT project domains: questions ### Should an NFT project register the domain before announcing the collection? Yes. A name announced publicly can be registered by anyone within minutes, so register the core set and the mint words first. The core set costs $128.94 a year. ### Does an NFT project need an ENS name as well? An ENS name helps wallets and apps that resolve it, but users reach a mint through a browser. The DNS names carry the phishing risk; see the comparison of ENS and DNS. ### What if a fake mint site already exists? Collect the address, a screenshot and the date, then report it to the registrar, the host and the blocklists. Wardmint explains the steps and does not perform takedowns. ### Can the whole team access the domains? One account holds them. Use a role-based mailbox, a strong password and two-factor authentication rather than sharing a personal login, and keep the account details in the project's password manager. ### How long does registration take? Registration is usually within minutes of the top-up being credited. If a name cannot be registered, if a domain cannot be registered (taken in the meantime, refused by the registry), the full amount goes back to your balance. **In summary** - Rare Bears (March 2022): a fake mint announced from a compromised moderator account, about $790,000 taken. - Check Point (2025): expired Discord invites led users to a fake bot and a phishing clone. - Register the exact name, the mint and claim words and the typos before the mint. - Core set $128.94 a year; endings phishers use $212.41 a year; same price at renewal. - Protect the registrar account, forward every variant and publish one official mint address. - Pay from a multisig in BTC, USDT, USDC, ETH, SOL, LTC; one verified email per domain, no identity documents. - Wardmint sells registrations, not monitoring or takedown, and only a project's own variants. ## Sources 1. [Hacker steals $790,000 of NFTs and crypto from owners of Rare Bears](https://www.theblock.co/post/138250/hacker-steals-790000-of-nfts-and-crypto-from-owners-of-rare-bears) — The Block, 17 March 2022 (read 2026-11-12) 2. [Inferno Drainer Reloaded](https://research.checkpoint.com/2025/inferno-drainer-reloaded-deep-dive-into-the-return-of-the-most-sophisticated-crypto-drainer/) — Check Point Research, 7 May 2025 (read 2026-11-12) 3. [Crypto phishing losses fall 83% to $84 million](https://drops.scamsniffer.io/scam-sniffer-2025-crypto-phishing-losses-fall-83-to-84-million/) — ScamSniffer, 3 January 2026 (read 2026-11-12) 4. [Phishing activity in TLDs, May 2025 to April 2026](https://www.cybercrimeinfocenter.org/phishing-activity-in-tlds-may-april-2026) — Cybercrime Information Center (Interisle data) (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # How do I protect the domains of a wallet or an exchange? > Wallets are copied through login pages and QR codes: Trezor and Ledger users got letters with look-alike domains in 2026. Core set $128.94/year. - URL: https://wardmint.com/use-cases/wallet-and-exchange-domains/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) A wallet or exchange asks users for the most sensitive things a website can ask: a login, a signature, a recovery phrase. Phishers copy those pages onto domains that look like yours. **Quick answer — How do I protect the domains of a wallet or an exchange?** Protect a wallet or exchange by registering your name on the extensions users try, redirecting each variant to the real site, blocking spoofed email on unused names, and watching for look-alike login pages. **Wardmint** prices the core set of six extensions at $128.94 a year and the finance words at $296.94 a year. ## How wallet and exchange brands are copied, and the matching defence | Attack | Example | Defence | | --- | --- | --- | | Look-alike login page | A copy of the sign-in page on a domain with a typo or another ending | Own the typos and the endings users try; redirect them to the real site | | QR code in a letter | Trezor- and Ledger-themed letters sent in early 2026 pointing to look-alike domains that asked for recovery phrases | Tell users in advance that you never ask for a recovery phrase | | Wallet drainer | A page that asks for a Permit or Permit2 signature; 38% of large 2025 drainer losses per ScamSniffer | Report and block fast; educate users on signature requests | | Fake support | A domain such as a support-themed name that offers help | Register .support and the support variants of your name | | Spoofed email | Mail sent as your brand from an unused domain you own or do not own | Null MX, SPF -all, DMARC p=reject on every unused variant | | Hijacked front end | Registrar-level redirect of the real domain, as at Curve in 2025 | Account security, transfer lock, DNSSEC, CAA records | ## How are wallet and exchange brands copied in practice? **Attackers send users to a page that looks like yours and ask for the one secret that matters.** In February 2026 a security researcher received a letter that appeared to come from Trezor, announcing a mandatory authentication check with a deadline of 15 February 2026. Its QR code led to a look-alike domain that asked for the wallet recovery phrase. Flare reported on 20 February 2026 that a similar Ledger-themed campaign had been running since at least October 2025. Both pages were later taken offline. Trezor and Ledger both state that they never ask for recovery phrases by mail, email, phone or website. The drainer side is large. ScamSniffer counted $83.85 million lost to wallet-drainer phishing sites in 2025 across 106,106 victims, with the largest single theft at $6.5 million through a Permit signature. On 30 October 2026, twelve DeFi sites registered with one registrar were redirected to the Step Drainer kit, and The Block traced about $138,000 to three EVM wallets. ## Which domains should a wallet or exchange register? **Register the exact name on the core extensions, the finance words that fit your product, and the endings phishers use most.** The core set (.com, .net, .org, .io, .xyz, .app) is $128.94 a year. The finance words (.finance, .exchange, .money, .cash, .capital, .fund) are $296.94 a year, and .exchange and .money suit a trading product. The endings phishers use (.xyz, .pro, .info, .shop, .online, .icu, .click, .live, .support) cost $212.41 a year as a set. According to Wardmint's survey of 12 November 2026, five of the nine endings in its phisher set (.xyz, .pro, .info, .shop and .icu) are among the ten extensions with the most phishing domains in Interisle's data for 1 May 2025 to 30 April 2026. Wardmint sells .support too: a fake help desk is a common lure for a wallet. It does not sell .top, the second-largest extension by count. See [which domains a crypto project should register](https://wardmint.com/which-domains-should-a-crypto-project-register/ "Which domains should a crypto project register?") for the method, and [the look-alike domain types phishers register](https://wardmint.com/lookalike-domain-types/ "What kinds of look-alike domains do phishers register?") for the typos to cover. ## How do I stop defensive domains being used against my users? **Make every variant do one useful thing: redirect to the real site, and send no mail.** Wardmint includes a "no email" DNS template (null MX, SPF -all, DMARC p=reject) so a defensive domain cannot be used to spoof your mail, free URL forwarding to send every variant to your main site, and automatic renewal from your balance so no variant lapses. For redirects, follow [how to redirect defensive domains to your main site](https://wardmint.com/guides/redirect-defensive-domains/ "How to redirect defensive domains to your main site"), and serve the redirect over HTTPS so users do not meet a certificate warning. For mail, [how to stop email spoofing on unused domains](https://wardmint.com/guides/stop-email-spoofing-on-unused-domains/ "How to stop email spoofing on unused domains") gives the exact records. Registering a variant does not make the page on it trusted, but it does stop an attacker from owning it. The domains you do not own remain, which is why monitoring matters. ## How do I find the look-alikes I did not register? **Generate the variants with dnstwist, then watch certificate logs for new ones.** dnstwist produces typo, homoglyph, TLD-swap and hyphen variants and checks which resolve. Certificate Transparency logs through crt.sh or CertStream show certificates issued for names containing your brand, often before a page is live. Wardmint does not provide monitoring or takedown; those are done with the free tools and official procedures. The method is in [how to find look-alike domains of your brand](https://wardmint.com/guides/find-lookalike-domains-of-your-brand/ "How to find look-alike domains of your brand"). Once you find one, report it to the registrar and the host with evidence, and add it to blocklists such as MetaMask's eth-phishing-detect. ## Wallet and exchange domains: questions ### Which extensions are best for an exchange? The core set, then .exchange, .trade, .money and .cash for the finance words, all sold by Wardmint at flat yearly prices. Add .support if users look for help. ### Can I register a domain with a competitor's name to block them? No. Wardmint registers a brand's own variants for that brand, never look-alikes of another brand. The acceptable use policy bans it. ### Do I need a trademark to register defensive domains? No mark is needed to register a domain at Wardmint. A mark is needed for a UDRP complaint against someone else's look-alike. ### Can an exchange pay from a treasury wallet? Yes. Wardmint takes BTC, USDT, USDC, ETH, SOL, LTC, with a $25 minimum top-up from any wallet, and asks for no ID. ### How fast is registration? Domains are registered usually within minutes of the top-up being credited. If one cannot be registered, if a domain cannot be registered (taken in the meantime, refused by the registry), the full amount goes back to your balance. **In summary** - Phishers copy login pages, QR-code letters, drainer pages and fake support. - Trezor and Ledger look-alike domains were used in letters in early 2026. - ScamSniffer: $83.85 million in drainer losses in 2025; Permit signatures were 38% of large cases. - Core set $128.94 a year; finance words $296.94 a year. - Redirect every variant to the real site and publish the no-email template. - Wardmint registers a brand's own variants only, never look-alikes of others. - Monitoring and takedown are done with free tools; Wardmint does not sell them. ## Sources 1. [Scammers are targeting crypto users by mail](https://flare.io/learn/resources/blog/scammers-targeting-crypto-users-mail) — Flare (read 2026-11-12) 2. [2025 crypto phishing losses fall 83% to $84 million](https://drops.scamsniffer.io/scam-sniffer-2025-crypto-phishing-losses-fall-83-to-84-million/) — ScamSniffer (read 2026-11-12) 3. [Hackers hijack a dozen DeFi websites, all registered with Name.com](https://theblock.co/news/defi/2026-10-31-hackers-hijack-a-dozen-defi-websites-all-registered-with-name-com-and-steal-about-138000-432251) — The Block (read 2026-11-12) 4. [Phishing activity in TLDs, May 2025 to April 2026](https://www.cybercrimeinfocenter.org/phishing-activity-in-tlds-may-april-2026) — Cybercrime Information Center (Interisle data) (read 2026-11-12) 5. [Curve Finance domain incident notice, 12 May 2025](https://news.curve.finance/curve-domain-incident/) — Curve Finance (read 2026-11-12) 6. [eth-phishing-detect](https://github.com/MetaMask/eth-phishing-detect) — MetaMask (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # What is a crypto wallet drainer? > A wallet drainer is a phishing kit that gets a signature and empties the wallet: $83.85M lost to 106,106 victims in 2025, per ScamSniffer. - URL: https://wardmint.com/what-is-a-wallet-drainer/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) A drainer does not break a wallet. It borrows a signature from its owner, on a page that looks like a project they trust, and uses it to move the assets out. **Quick answer — What is a crypto wallet drainer?** A crypto wallet drainer is a phishing kit, usually rented as a service, that shows a fake site or a hijacked real one, asks the visitor to connect a wallet and sign, and then moves the assets out. ScamSniffer counted $83.85M stolen from 106,106 victims in 2025. **Wardmint** registers the look-alike names a project can take before attackers do. ## Wallet-drainer phishing losses on EVM chains, 2023 to 2025 *ScamSniffer annual report published 3 January 2026. The report covers phishing-website drainers only and is a lower bound.* | Year | Losses | Victims | Cases of $1M or more | | --- | --- | --- | --- | | 2023 | $295M | 324,000 | 13 | | 2024 | $494M | 332,000 | 30 | | 2025 | $83.85M | 106,106 | 11 | ## Signature types that drainers ask for *Names of the signature types as listed in the ScamSniffer 2025 report; the plain-language column is Wardmint's own explanation.* | Signature type | What the victim actually allows | Reported in 2025 | | --- | --- | --- | | approve | A named address may spend a set amount of one token | Listed as a common type | | permit / Permit2 | The same allowance, granted by an off-chain signature with no on-chain transaction from the victim | 38% of losses in cases of $1M or more ($8.72M, 3 cases); the largest 2025 theft, $6.5M in September, used a Permit signature | | setApprovalForAll | A named address may move every NFT in a collection | Listed as a common type | | increaseApproval, Transfer | A larger allowance or a direct token transfer | Listed as types in use | | EIP-7702 batch | Delegated account code that runs several actions at once | Appeared after the Pectra upgrade; 2 large cases in August, $2.54M | ## How does a wallet drainer work? **It works in three steps: lure, connect, sign.** The lure is a link in a message, an ad or a social profile that points to a page copying a real project. The page asks the visitor to connect a wallet, which reveals the address and the tokens it holds. The kit then builds one or more signature requests that look routine, such as a claim, a mint or a verification. Once the victim signs, the operator uses the approval or the transfer to take the assets, usually within moments. ScamSniffer defines a wallet drainer as phishing infrastructure on malicious websites that induces users to sign harmful transactions, which allows fast extraction. The kit does not need a seed phrase. The user supplies the authority voluntarily, which is why the page that asks for it has to look credible, and why the domain it sits on matters so much. ## Where do drainers get their domains? **They use look-alike domains registered for the campaign, and increasingly the project's own domain after a hijack.** The look-alike route is the plain one: examplecoin-claim.xyz or examplecoin-airdrop.com, a copy of the project page, a connect button. Variants of this kind are described in [what kinds of look-alike domains phishers register](https://wardmint.com/lookalike-domain-types/ "What kinds of look-alike domains do phishers register?"), and the airdrop pattern is covered in [how fake airdrop claim sites and phishing domains work](https://wardmint.com/fake-airdrop-phishing-domains/ "How do fake airdrop claim sites and phishing domains work?"). The hijack route skips the look-alike entirely. Blockaid attributed the five front-end compromises of 16 to 23 February 2026 to the AngelFerno drainer service, previously known as Inferno, with new SSL certificates issued the same day as the DNS change. The Block reported that about a dozen DeFi sites registered with Name.com were redirected on the evening of 30 October 2026 and loaded with Step Drainer, a malware-as-a-service toolkit, with about $138,000 traced to three EVM wallets. In both cases the visitor typed the real address. ## How much do drainers steal, and is it falling? **ScamSniffer reports that drainer losses fell 83% in 2025, to $83.85M, while the broader scam picture grew.** The 2025 total is a fraction of 2024's $494M, and victims fell 68%. The report counted 11 cases of $1M or more against 30 in 2024. It also found that Permit and Permit2 signatures made up 38% of the losses in large cases, and that the peak month was August 2025 with $12.17M and 15,230 victims. A falling total does not mean a safe user base. Chainalysis, in its report of 13 January 2026, put crypto scams and fraud at no less than $14 billion received on-chain in 2025, with impersonation scams up more than 1,400% on 2024 and the average scam payment rising from $782 to $2,764. Drainers are one tool in that picture, and the Chainalysis text reports that scams using phishing kits were far more effective in dollar terms than ordinary ones. ScamSniffer's own caveat applies too: its figure counts phishing-website drainers only. ## What can a project do to stop drainers using its name? **Take the obvious names, harden the real one and make reporting fast.** According to Wardmint's survey of 12 November 2026, 40 of the 50 largest crypto projects had no registered -claim .com name and 39 of 50 had no registered -airdrop .com name in RDAP, so the exact words a claim lure needs were open to anyone. The full results, with the 171 of 578 variants (29.6%) that were free, are on the [crypto project defensive domain audit 2026](https://wardmint.com/data/crypto-project-defensive-domain-audit-2026/ "How many look-alike domains of the top crypto projects can anyone register?") page. A project can act in four ways. Register its own variants and redirect them to the official site; the phisher set (.xyz, .pro, .info, .shop, .online, .icu, .click, .live, .support) is $212.41 a year. Harden the registrar account and DNS using the [domain security checklist for a crypto project](https://wardmint.com/crypto-project-domain-security-checklist/ "What is the domain security checklist for a crypto project?"). Find existing look-alikes with the free tools in [how to find look-alike domains of your brand](https://wardmint.com/guides/find-lookalike-domains-of-your-brand/ "How to find look-alike domains of your brand"). And report any live one by following [how to report a phishing domain](https://wardmint.com/guides/report-a-phishing-domain/ "How to report a phishing domain"). Wardmint sells registrations only, not monitoring or takedown, and it registers a project's own variants, never another brand's. ## What can a user do before signing? **Read what the wallet says it will do, and treat any request you did not start as hostile.** A connect request on a page reached from an ad or a message is the point to stop. Open the project from a bookmark or from its verified channels, check that the address is exactly the one the project announced, and read the signature prompt. A request to approve spending of a token, to approve a whole NFT collection or to sign a Permit for a claim is the pattern in the table above. Keep long-term holdings in a wallet that you do not use to connect to new sites. Projects can help users by announcing a single official address before each event. A citable rule: a legitimate claim never needs a seed phrase, and a signature that grants an allowance is not a claim. ## Wallet drainers: questions ### Is a wallet drainer malware on my computer? Not usually. The drainers in these reports run as scripts on a phishing website and act through the wallet you connect. The risk comes from the signature you give, not from software installed on your device. ### Why does a drainer not need my seed phrase? A signed approval or Permit gives the attacker the right to move your tokens without any key. The authority is granted by the signature, and it stays valid until revoked or used. ### Did drainer losses really fall in 2025? Yes, in ScamSniffer's data they fell 83% to $83.85M across 106,106 victims, from $494M in 2024. The report covers phishing-website drainers only and is a lower bound. ### Can registering domains stop drainers? It removes the names a drainer operator would try first, such as a project name with claim or airdrop added. It does not stop attacks on other words, subdomains on hosting platforms or a hijack of the real domain. ### What should a project do after finding a drainer site? Report the domain to its registrar and host, add it to the blocklists, warn users on every verified channel and record screenshots for any later dispute. The reporting order is in the Wardmint guide on reporting a phishing domain. **In summary** - A wallet drainer is a phishing kit that gets a signature and moves assets, with no seed phrase needed. - ScamSniffer: $83.85M and 106,106 victims in 2025, against $494M and 332,000 in 2024. - Permit and Permit2 made up 38% of losses in cases of $1M or more; the largest was $6.5M in September 2025. - Drainers run on look-alike domains and on hijacked real domains (February and October 2026 reports). - Chainalysis (13 January 2026): at least $14 billion in crypto scams received on-chain in 2025. - 40 of 50 -claim .com and 39 of 50 -airdrop .com names of the top 50 projects were free on 12 November 2026. - Wardmint sells registrations, not monitoring or takedown; nine phisher endings cost $212.41 a year. ## Sources 1. [Scam Sniffer 2025 crypto phishing losses fall 83% to $84 million](https://drops.scamsniffer.io/scam-sniffer-2025-crypto-phishing-losses-fall-83-to-84-million/) — ScamSniffer, 3 January 2026 (read 2026-11-12) 2. [2026 Crypto Scams report](https://www.chainalysis.com/blog/crypto-scams-2026/) — Chainalysis, 13 January 2026 (read 2026-11-12) 3. [Frontend hijacking and the Web2 attack surface threatening Web3 protocols](https://blockaid.io/blog/frontend-hijacking-and-the-web2-attack-surface-threatening-web3-protocols) — Blockaid, 19 March 2026 (read 2026-11-12) 4. [Hackers hijack a dozen DeFi websites registered with Name.com](https://theblock.co/news/defi/2026-10-31-hackers-hijack-a-dozen-defi-websites-all-registered-with-name-com-and-steal-about-138000-432251) — The Block, 31 October 2026 (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # What is an IDN homograph attack? > An IDN homograph attack swaps Latin letters for look-alikes from other scripts; the name is stored as punycode (xn--) and Chrome decides per label. - URL: https://wardmint.com/what-is-an-idn-homograph-attack/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) Two domain names can look identical on screen and be different strings. This page shows how, what the xn-- prefix means, and where the browser steps in. **Quick answer — What is an IDN homograph attack?** An IDN homograph attack registers an internationalized domain name whose Cyrillic or Greek letters look like Latin ones, so exаmplecoin.com reads as examplecoin.com. It is stored as punycode starting xn--. Chrome shows that raw form for mixed-script labels and, since version 51, ignores the user's language setting. **Wardmint** registers the ASCII variants of your name. ## The same-looking names and what the system stores *Examples use the fictional brand examplecoin. The ASCII forms were computed with Node.js (url.domainToASCII) on 12 November 2026.* | Shown as | What differs | Stored in the DNS as | | --- | --- | --- | | examplecoin.com | Plain Latin letters, the real name | examplecoin.com | | exаmplecoin.com | The second letter is Cyrillic а (U+0430), mixed with Latin letters | xn--exmplecoin-0qi.com | | еxamplecoin.com | The first letter is Cyrillic е (U+0435), mixed with Latin letters | xn--xamplecoin-jsi.com | | аррӏе.com | Every letter is Cyrillic: а, р, р, ӏ, е | xn--80ak6aa92e.com | *Convert a suspicious name to its stored form* ```bash node -e "console.log(require('url').domainToASCII('аррӏе.com'))" # xn--80ak6aa92e.com ``` ## How does an IDN homograph attack work? **It works because Unicode contains letters from different alphabets that look the same, and the domain system lets anyone register names that use them.** An internationalized domain name (IDN) is a name with non-ASCII characters. The DNS only handles ASCII, so each such label is converted to punycode, a string that begins with xn-- followed by an encoded form. A person sees the Unicode version if the browser decides to display it; software that stores or logs the name sees the xn-- form. The attacker registers a name where one or more Latin letters are replaced by a look-alike: Cyrillic а instead of Latin a, for example. The registry and registrar accept it because it is a valid name. The visitor reads examplecoin.com and signs a transaction on a copy of your site. ## What does the xn-- prefix mean? **The prefix xn-- marks a label that holds non-ASCII characters in encoded form.** In the examples above, xn--exmplecoin-0qi.com is the stored form of exаmplecoin.com: the ASCII letters of the label come first and the encoded Cyrillic character follows the hyphen. A name that begins with xn-- is not malicious in itself; many legitimate sites in other languages use it. What matters is whether the decoded string imitates a brand. You can decode any suspicious name in a script like the one above, or paste it into a lookup tool, before you click. ## How does Chrome decide to show Unicode or punycode? **Chrome decides for each label separately and shows the xn-- form whenever a check fails.** The documented checks include mixing scripts that should not mix (Latin with Cyrillic or Greek), mixed-script confusables from the Unicode security data, and labels made only of look-alike letters from one script when the extension is not in that script. Chrome also rejects labels made only of digits or digit look-alikes, and labels that match a top domain once accents are stripped. If every check passes, the label is shown in Unicode. The policy does not depend on the user's language setting. The all-Cyrillic аррӏе.com in the table is the whole-script case: it mixes nothing, so a mixed-script rule does not catch it, and Chrome relies on its separate whole-script check. Other browsers have their own policies, which Wardmint has not read, so this page documents Chrome only. The related risk of address confusion in general is in [what kinds of look-alike domains phishers register](https://wardmint.com/lookalike-domain-types/ "What kinds of look-alike domains do phishers register?"). ## How do I protect my brand from homograph domains? **Register the ASCII variants you can, monitor for the rest, and report what you find.** A homograph name cannot be registered by you in advance in every script, because the combinations are too many. What you can do is search for them: dnstwist generates homoglyph names from a researched set of Unicode characters and checks which exist, and certificate logs show names that carry your brand in decoded form. [The guide to finding look-alike domains](https://wardmint.com/guides/find-lookalike-domains-of-your-brand/ "How to find look-alike domains of your brand") has the commands, and [how to monitor certificate transparency](https://wardmint.com/guides/monitor-certificate-transparency/ "How to monitor certificate transparency for your brand") covers the logs. Wardmint's pages describe registrations of ASCII names and do not claim IDN registration. For the ASCII homoglyphs (1 for l, rn for m) the coverage is the same as for any typo: see [how to protect your brand from typosquatting](https://wardmint.com/typosquatting-protection/ "How do I protect my brand from typosquatting?"). ## What do Wardmint's figures say about it? Wardmint checked the Chromium policy on 12 November 2026 and grouped its rules into 5 families of checks that decide between Unicode and punycode: conversion and validity, script mixing, numbering and invisible characters, confusables, and digits, patterns and top domains. The grouping is Wardmint's own; the rules are Chromium's. A homograph domain is a domain name whose letters differ from a known name but look identical to a reader. An IDN homograph attack is the use of such a name to impersonate a brand. Punycode is the ASCII encoding, beginning with xn--, that the DNS stores for names with non-ASCII letters. ## Questions about homograph attacks ### Can I see the real name behind a Unicode domain? Yes. Convert it to its stored form with a one-line script or a lookup tool, and read the xn-- string and the registrar data. A mismatch with the name you expected is a warning. ### Does an HTTPS padlock protect me from a homograph site? No. A look-alike domain can get a certificate like any other, so the padlock proves an encrypted connection, not the identity of the site. ### Does Chrome block every homograph domain? No. It applies a documented set of checks and shows punycode when one fails. A name that passes all of them is shown in Unicode, so treat unfamiliar links with care. ### Can I report an IDN look-alike like any other phishing domain? Yes. Use the registrar abuse route with the stored xn-- name, the decoded name and a screenshot. The steps are the same as for any phishing domain. **In summary** - An IDN homograph attack replaces Latin letters with look-alikes from other scripts. - The DNS stores the name as punycode, beginning xn--. - Chrome decides per label and ignores the user's language since version 51. - Mixed Latin and Cyrillic labels are shown as xn-- by Chrome. - HTTPS does not prove who owns a look-alike. - Find them with dnstwist and certificate logs; report them as phishing domains. - Wardmint registers the ASCII variants of your own name across 29 extensions. ## Sources 1. [Chromium IDN display policy (docs/idn.md)](https://chromium.googlesource.com/chromium/src/+/main/docs/idn.md) — The Chromium Projects (read 2026-11-12) 2. [dnstwist, domain name permutation engine](https://github.com/elceef/dnstwist) — GitHub (elceef/dnstwist) (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year. --- # Which domains should a crypto project register? > Register .com, .net, .org, .io, .xyz and .app first: $128.94 a year at Wardmint, then add finance words and the endings phishers use. - URL: https://wardmint.com/which-domains-should-a-crypto-project-register/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) Four layers, in this order: the extensions users guess, the finance words, the endings phishers favour, and your own typos. Each has a yearly total at our prices. **Quick answer — Which domains should a crypto project register?** A crypto project should register its name under the extensions users guess and phishers favour: .com, .net, .org, .io, .xyz and .app first. **Wardmint** prices that core set at $128.94 a year for six names, with finance words and phisher endings as optional layers. ## Four defensive sets and their yearly totals *Totals at Wardmint prices of 12 November 2026; each name costs the same every year.* | Set | Extensions | Names | Per year | Over 3 years | | --- | --- | --- | --- | --- | | Core set | .com, .net, .org, .io, .xyz, .app | 6 | $128.94 | $386.82 | | Finance words | .finance, .exchange, .money, .cash, .capital, .fund | 6 | $296.94 | $890.82 | | Endings phishers use | .xyz, .pro, .info, .shop, .online, .icu, .click, .live, .support | 9 | $212.41 | $637.23 | | Token launch | .com, .io, .xyz, .app, .finance, .network | 6 | $195.94 | $587.82 | ## Ten extensions with the most phishing domains, and which ones Wardmint sells *Interisle data, 1 May 2025 to 30 April 2026. The score is phishing domains per 10,000 delegated domains.* | Extension | Phishing domains | Score | Sold by Wardmint | | --- | --- | --- | --- | | .com | 869,180 | 53.7 | Yes | | .top | 375,514 | 596.1 | No | | .cn | 167,651 | 135.7 | No | | .pro | 130,945 | 1,200.1 | Yes | | .info | 99,602 | 189.7 | Yes | | .xyz | 93,987 | 118.2 | Yes | | .vip | 83,816 | 501 | No | | .shop | 79,625 | 202 | Yes | | .cc | 77,660 | 319.4 | No | | .icu | 74,786 | 1,607 | Yes | ## What is the core set, and why those six? **The core set is .com, .net, .org, .io, .xyz and .app, because it holds the extensions a user would type by hand and the ones a crypto project actually uses.** .com is where a mistyped address lands by default. .io and .xyz are common choices for protocols, so a clone on either looks plausible. .app suits a web front end. At $128.94 a year, or $386.82 over three years, it is the least you can do before a public launch. The individual prices are $12.49/year for .com, $13.49/year for .net, $12.49/year for .org, $59.49/year for .io, $14.99/year for .xyz and $15.99/year for .app. If your project already owns some of them, remove those from the list and keep the rest. ## Should a crypto project add finance extensions? **Yes, if it handles funds: .finance, .exchange, .money, .cash, .capital and .fund make a serious-sounding address for a fake.** A visitor who reads examplecoin.finance in a message does not find it odd. The set costs $296.94 a year for six names, much more than the core set because the registry prices are higher: .finance alone is $60.49/year. A smaller team can take only the two or three words that match its product, for example .exchange for a trading venue and .fund for a vault. The page on [defensive domain registration cost](https://wardmint.com/defensive-domain-registration-cost/ "How much does defensive domain registration cost?") sets these totals against the price of a dispute. ## Which endings do phishers use most? **Phishers use .com by volume and cheap new extensions by share: .pro, .info, .xyz, .shop and .icu all sit in Interisle's top ten by count.** The "endings phishers use" set holds nine names: .xyz, .pro, .info, .shop, .online, .icu, .click, .live and .support, for $212.41 a year. Five of them are in the table above. The other four were chosen because a word such as .support or .live fits a fake help desk or a fake stream, and Wardmint did not find per-extension counts for them in the data it read. The scores differ from the counts. .com has 869,180 phishing domains but a score of 53.7, because it is enormous; .icu scores 1,607 and .pro 1,200.1. We do not sell .top, the second on the list, because its price cannot sit under Namecheap's regular renewal. For the data behind this choice, see [which domain extensions are most used for phishing](https://wardmint.com/most-abused-tlds-for-phishing/ "Which domain extensions are most used for phishing?"). ## How many typo variants are enough? **Start with a dozen typos of your main .com and stop where the returns fall.** Omit one letter, swap two neighbouring letters, double a letter, and add a hyphen between two words. Then register your name with the usual attack words: login, claim, airdrop, support. A bulk search handles up to 50 names in one go, so the whole list takes one cart. [The guide to building a defensive domain list](https://wardmint.com/guides/build-a-defensive-domain-list/ "How to build a defensive domain list for your brand") shows how to rank the candidates by what a user would plausibly type. ## What does Wardmint's data say about the extensions to buy? According to Wardmint's survey of 12 November 2026, 6 of the 10 extensions with the most phishing domains in Interisle's data are on sale here: .com, .pro, .info, .xyz, .shop and .icu. Wardmint prices all 29 extensions under Namecheap's regular renewal, by a median of 33%. A defensive set is a short list of names a project owns so that nobody else can use them against it. The core set of .com, .net, .org, .io, .xyz and .app is the smallest defensive set that Wardmint recommends. ## Questions about choosing extensions ### Do I need all 29 extensions? No. Most teams need the core set and two or three finance words that match their product. The rest is for projects with a large user base that a phisher would find worth targeting. ### Is .ai worth registering? For an AI-related project, yes. .ai costs $88.49/year and is sold two years at a time, so the first payment covers two years. ### What if the name is already taken under an extension? Then it is not available to you, and a UDRP complaint is the route if the holder registered it in bad faith against a mark you hold. Check who owns it first, then decide. ### Should I register .eth or .crypto names too? They sit outside the ICANN domain system and Wardmint does not sell them. Register the ICANN extensions first, because that is where browsers and link previews resolve. ### Can I add domains after the launch? Yes. Add them to the cart whenever you see a new look-alike, from the same prepaid balance, at the same yearly price. **In summary** - Core set: .com, .net, .org, .io, .xyz, .app for $128.94 a year. - Finance words (six names) cost $296.94 a year. - Endings phishers use (nine names) cost $212.41 a year. - Token launch set costs $195.94 a year. - 6 of the 10 extensions with the most phishing domains in Interisle's data are sold here. - Wardmint does not sell .top; it prices 29 extensions under Namecheap's renewal, median 33% under. - Add typos and attack words through a bulk search of up to 50 names. ## Sources 1. [Phishing Activity in TLDs, May 2025 to April 2026](https://www.cybercrimeinfocenter.org/phishing-activity-in-tlds-may-april-2026) — Cybercrime Information Center (Interisle data) (read 2026-11-12) 2. [Namecheap regular renewal prices, domainoffer.net listing](https://domainoffer.net/tld/com/namecheap) — domainoffer.net (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year.