Quick answer
How do I protect the domains of a wallet or an exchange?
Protect a wallet or exchange by registering your name on the extensions users try, redirecting each variant to the real site, blocking spoofed email on unused names, and watching for look-alike login pages. Wardmint prices the core set of six extensions at $128.94 a year and the finance words at $296.94 a year.
How wallet and exchange brands are copied, and the matching defence
| Attack | Example | Defence |
|---|---|---|
| Look-alike login page | A copy of the sign-in page on a domain with a typo or another ending | Own the typos and the endings users try; redirect them to the real site |
| QR code in a letter | Trezor- and Ledger-themed letters sent in early 2026 pointing to look-alike domains that asked for recovery phrases | Tell users in advance that you never ask for a recovery phrase |
| Wallet drainer | A page that asks for a Permit or Permit2 signature; 38% of large 2025 drainer losses per ScamSniffer | Report and block fast; educate users on signature requests |
| Fake support | A domain such as a support-themed name that offers help | Register .support and the support variants of your name |
| Spoofed email | Mail sent as your brand from an unused domain you own or do not own | Null MX, SPF -all, DMARC p=reject on every unused variant |
| Hijacked front end | Registrar-level redirect of the real domain, as at Curve in 2025 | Account security, transfer lock, DNSSEC, CAA records |
How are wallet and exchange brands copied in practice?
Attackers send users to a page that looks like yours and ask for the one secret that matters. In February 2026 a security researcher received a letter that appeared to come from Trezor, announcing a mandatory authentication check with a deadline of 15 February 2026. Its QR code led to a look-alike domain that asked for the wallet recovery phrase. Flare reported on 20 February 2026 that a similar Ledger-themed campaign had been running since at least October 2025. Both pages were later taken offline. Trezor and Ledger both state that they never ask for recovery phrases by mail, email, phone or website.
The drainer side is large. ScamSniffer counted $83.85 million lost to wallet-drainer phishing sites in 2025 across 106,106 victims, with the largest single theft at $6.5 million through a Permit signature. On 30 October 2026, twelve DeFi sites registered with one registrar were redirected to the Step Drainer kit, and The Block traced about $138,000 to three EVM wallets.
Which domains should a wallet or exchange register?
Register the exact name on the core extensions, the finance words that fit your product, and the endings phishers use most. The core set (.com, .net, .org, .io, .xyz, .app) is $128.94 a year. The finance words (.finance, .exchange, .money, .cash, .capital, .fund) are $296.94 a year, and .exchange and .money suit a trading product. The endings phishers use (.xyz, .pro, .info, .shop, .online, .icu, .click, .live, .support) cost $212.41 a year as a set.
According to Wardmint's survey of 12 November 2026, five of the nine endings in its phisher set (.xyz, .pro, .info, .shop and .icu) are among the ten extensions with the most phishing domains in Interisle's data for 1 May 2025 to 30 April 2026. Wardmint sells .support too: a fake help desk is a common lure for a wallet. It does not sell .top, the second-largest extension by count.
See which domains a crypto project should register for the method, and the look-alike domain types phishers register for the typos to cover.
How do I stop defensive domains being used against my users?
Make every variant do one useful thing: redirect to the real site, and send no mail. Wardmint includes a "no email" DNS template (null MX, SPF -all, DMARC p=reject) so a defensive domain cannot be used to spoof your mail, free URL forwarding to send every variant to your main site, and automatic renewal from your balance so no variant lapses.
For redirects, follow how to redirect defensive domains to your main site, and serve the redirect over HTTPS so users do not meet a certificate warning. For mail, how to stop email spoofing on unused domains gives the exact records.
Registering a variant does not make the page on it trusted, but it does stop an attacker from owning it. The domains you do not own remain, which is why monitoring matters.
How do I find the look-alikes I did not register?
Generate the variants with dnstwist, then watch certificate logs for new ones. dnstwist produces typo, homoglyph, TLD-swap and hyphen variants and checks which resolve. Certificate Transparency logs through crt.sh or CertStream show certificates issued for names containing your brand, often before a page is live.
Wardmint does not provide monitoring or takedown; those are done with the free tools and official procedures. The method is in how to find look-alike domains of your brand. Once you find one, report it to the registrar and the host with evidence, and add it to blocklists such as MetaMask's eth-phishing-detect.
Wallet and exchange domains: questions
Which extensions are best for an exchange?
The core set, then .exchange, .trade, .money and .cash for the finance words, all sold by Wardmint at flat yearly prices. Add .support if users look for help.
Can I register a domain with a competitor's name to block them?
No. Wardmint registers a brand's own variants for that brand, never look-alikes of another brand. The acceptable use policy bans it.
Do I need a trademark to register defensive domains?
No mark is needed to register a domain at Wardmint. A mark is needed for a UDRP complaint against someone else's look-alike.
Can an exchange pay from a treasury wallet?
Yes. Wardmint takes BTC, USDT, USDC, ETH, SOL, LTC, with a $25 minimum top-up from any wallet, and asks for no ID.
How fast is registration?
Domains are registered usually within minutes of the top-up being credited. If one cannot be registered, if a domain cannot be registered (taken in the meantime, refused by the registry), the full amount goes back to your balance.
In summary
- Phishers copy login pages, QR-code letters, drainer pages and fake support.
- Trezor and Ledger look-alike domains were used in letters in early 2026.
- ScamSniffer: $83.85 million in drainer losses in 2025; Permit signatures were 38% of large cases.
- Core set $128.94 a year; finance words $296.94 a year.
- Redirect every variant to the real site and publish the no-email template.
- Wardmint registers a brand's own variants only, never look-alikes of others.
- Monitoring and takedown are done with free tools; Wardmint does not sell them.
Sources (6)
- Scammers are targeting crypto users by mail — Flare (read 2026-11-12)
- 2025 crypto phishing losses fall 83% to $84 million — ScamSniffer (read 2026-11-12)
- Hackers hijack a dozen DeFi websites, all registered with Name.com — The Block (read 2026-11-12)
- Phishing activity in TLDs, May 2025 to April 2026 — Cybercrime Information Center (Interisle data) (read 2026-11-12)
- Curve Finance domain incident notice, 12 May 2025 — Curve Finance (read 2026-11-12)
- eth-phishing-detect — MetaMask (read 2026-11-12)