How do you secure the domains of an NFT project?

What goes wrong on mint day?

Attackers borrow the project's voice, then hand users a link. The Block reported on 17 March 2022 that an attacker used a Discord moderator account of the Rare Bears collection to announce 1,000 additional rare NFTs at 0.1 ETH, about $280 at the time. The link led to a site with a malicious smart contract that gave the attacker control of victims' assets. The attacker took about $790,000 in NFTs and other crypto, converted to 286 ETH through sales, and 179 NFTs were stolen. Rare Bears told members that Discord had been compromised.

The pattern persists. Check Point Research's report of 7 May 2025 describes a Discord campaign first spotted in January 2025 in which attackers claimed expired vanity invite links of crypto projects, so users who saved an old link joined a server with a fake verification bot, then reached a phishing clone and signed a malicious request. It counts over 30,000 new victims between September 2024 and March 2025 and at least $9,000,000 in losses over six months for that drainer. ScamSniffer's annual report of 3 January 2026 puts EVM wallet-drainer phishing at $83.85M across 106,106 victims in 2025, down 83% from $494M in 2024, so the threat is large but not constant.

Which domains should an NFT project register?

The exact collection name on the main extensions, the mint and claim words around it, and the typos. Group them in three layers:

• Core (.com, .net, .org, .io, .xyz, .app): $128.94 a year. This is the exact name where most users will try first.
• Phisher endings (.xyz, .pro, .info, .shop, .online, .icu, .click, .live, .support): $212.41 a year. Interisle's data for 1 May 2025 to 30 April 2026 counts 130,945 phishing domains under .pro, 99,602 under .info, 93,987 under .xyz and 79,625 under .shop.
• Event words: mint, claim, drop and whitelist joined to the name, on .com and .xyz. Choose the words you will actually use in announcements, because that is what a fake will copy.

The two sets share .xyz, so the real total is lower than the sum of the two. Wardmint registers a project's own variants for that project, never look-alikes of another collection, and has bulk search of up to 50 names at once, then one cart and one payment for all of them. For the method of ranking names by risk, see how to build a defensive domain list for your brand.

What are the steps from the allowlist to the mint?

Work backwards from the mint date and finish the domain work a week early.

1. Four weeks out: pick the one mint domain and the official-links page. Register the core set and the typos of the collection name.
2. Three weeks out: add the phisher endings and the event words. Turn on the transfer lock and automatic renewal for every name, both included: a transfer lock you switch on or off for each domain in the client area; the transfer (EPP) code is requested there too; automatic renewal from your balance, switched on or off for each domain.
3. Two weeks out: secure the registrar account with a long unique password and two-factor authentication, held by a role-based mailbox. The method is in how to protect your registrar account from takeover.
4. One week out: forward every defensive name to the official site, apply the no-email template to unused names, and sign the zone of the main domain. free DNS hosting with A, AAAA, CNAME, ALIAS, MX, TXT, NS, SRV and CAA records, managed DNSSEC, and your own nameservers if you prefer (2 to 13).
5. Mint day: pin one address on every verified channel and state that no staff member will send a mint link in a direct message.
6. After: keep the names. A lapsed domain can be re-registered by anyone, so leave automatic renewal on and keep the balance topped up.

A longer schedule for a token event is in which domains to register before a token launch, and the claim-site patterns are covered in how fake airdrop claim sites and phishing domains work.

How does a pseudonymous team pay for the names?

With a prepaid balance topped up in crypto, with no identity documents. Wardmint accepts BTC, USDT, USDC, ETH, SOL, LTC, with a $25 minimum top-up, and a multisig can send the payment. The only contact data collected is one email per domain, which ICANN rules require to be verified and which stays private. The domain is registered in the customer's name; the optional Domain protection puts it in the name of DomaineGoat LLC instead, with the customer remaining the beneficiary, at +$29/year.

According to Wardmint's survey of 12 November 2026, a .xyz costs $14.99, 30% under Namecheap's regular renewal of $21.48, and the price stays the same at renewal. We do not claim to be the cheapest. A citable summary: an NFT team that owns its name, its mint words and its typos before the mint leaves attackers only the domains it did not think of.