How do I protect my crypto project from phishing domains?

Why do phishers target crypto projects through domains?

A domain that looks like yours is an inexpensive way to take your users' wallets. The attacker needs no exploit in your contracts: one convincing page and one wallet-signature request are enough.

The volume is large. Chainalysis estimated that crypto scams received at least $14 billion on-chain in 2025 and that impersonation scams grew about 1,400% year over year (Chainalysis, 13 January 2026). ScamSniffer counted $83.85 million lost to wallet-drainer phishing websites in 2025 across 106,106 victims, down from $494 million in 2024, and calls its figure a lower bound. APWG recorded 1,069,681 phishing attacks in the second quarter of 2026.

Interisle found that 77% of phishing domains in its 2025 report were registered by the criminals themselves, not hacked from other sites. That is why registering the obvious names first works: a name you own cannot be bought by someone else.

Which domains should I register first?

Register your exact name on the extensions attackers copy, then the typos of your name, before you announce anything. The order of priority is the one buyers of your token will type or click.

Start with the core set (.com, .net, .org, .io, .xyz, .app), which costs $128.94 a year at Wardmint. Add the finance words (.finance, .exchange, .money, .cash, .capital, .fund) at $296.94 a year if your project handles swaps or custody. The endings phishers use most, .xyz, .pro, .info, .shop, .online, .icu, .click, .live and .support, come to $212.41 a year as a set.

Wardmint registers a brand's own variants for that brand. It does not register look-alikes of someone else's brand, and its acceptable use policy bans it. For the full reasoning on which names to pick, read which domains a crypto project should register.

How do I harden the domains I own?

Harden a domain by protecting the account that controls it, then the records it publishes. The account matters most: the recorded hijacks of Curve Finance (August 2022 and 12 May 2025) happened at the registrar level, not in the contracts.

• Registrar account: use a long unique password, two-factor authentication and an email address used for nothing else. Wardmint provides a transfer lock you switch on or off for each domain in the client area; the transfer (EPP) code is requested there too.
• DNS: Wardmint provides free DNS hosting with A, AAAA, CNAME, ALIAS, MX, TXT, NS, SRV and CAA records, managed DNSSEC, and your own nameservers if you prefer (2 to 13). Sign the zone with DNSSEC and publish CAA records so only the certificate authority you choose can issue certificates.
• Unused names: apply the no-email template so a defensive domain cannot send spoofed mail from your brand: a null MX, SPF -all and DMARC p=reject.
• Redirects: point every variant to your main site with free URL forwarding, so a mistyped address lands on the real page.

Registry lock, offered by Verisign for .com and .net through participating registrars, is not offered by Wardmint. The registry lock versus registrar lock page explains what it adds and when a team needs it.

How do I monitor for look-alike sites?

Generate the look-alikes yourself and watch the certificate logs, both for free. dnstwist is an open-source tool that produces typo, homoglyph, TLD-swap and hyphen variants of your domain and checks which ones resolve. Certificate Transparency logs, searched through crt.sh or streamed through CertStream, list a certificate for a copy of your name often before the page goes live.

Wardmint sells registrations, not monitoring. Paid web3 monitoring and takedown services exist; their prices are not published. A small team can run dnstwist weekly and a CertStream filter on its brand string at no cost. The step-by-step method is in how to find look-alike domains of your brand.

What do I do when a phishing domain appears?

Collect evidence first, then report to the registrar and the host in the same hour. Take screenshots, the full URL, the date and time, the wallet addresses the page asks users to sign for, and the certificate details.

Since 5 April 2024, ICANN's amended agreements require accredited registrars to act promptly when they hold actionable evidence of phishing, malware, botnets or pharming. Report through the registrar's abuse contact, found with an RDAP lookup. Add the site to the MetaMask eth-phishing-detect blocklist, which is open to pull requests, and report it to Google Safe Browsing and Netcraft; a Safe Browsing report warns users but does not remove the site.

If the domain copies a trademark you hold, a UDRP complaint at WIPO costs USD 1,500 for one to five domains with a single panelist. See how to report a phishing domain and the first-hour checklist for an impersonation incident.

What does the data say about the extensions to cover?

Most of the extensions with the highest phishing counts are ones a project can own cheaply. According to Wardmint's survey of 12 November 2026, 6 of the 10 extensions with the most phishing domains in Interisle's data for 1 May 2025 to 30 April 2026 (.com, .pro, .info, .xyz, .shop and .icu) are on sale at Wardmint, each under Namecheap's regular renewal price read that day. The other four, .top, .cn, .vip and .cc, are not sold here.

Wardmint is a defensive registration service for crypto projects: it sells the names, and the guides on this site show the free tools and official procedures for everything else. Wardmint's guidance is to register before you announce.