Quick answer
Which domains should a crypto project register?
A crypto project should register its name under the extensions users guess and phishers favour: .com, .net, .org, .io, .xyz and .app first. Wardmint prices that core set at $128.94 a year for six names, with finance words and phisher endings as optional layers.
Four defensive sets and their yearly totals
| Set | Extensions | Names | Per year | Over 3 years |
|---|---|---|---|---|
| Core set | .com, .net, .org, .io, .xyz, .app | 6 | $128.94 | $386.82 |
| Finance words | .finance, .exchange, .money, .cash, .capital, .fund | 6 | $296.94 | $890.82 |
| Endings phishers use | .xyz, .pro, .info, .shop, .online, .icu, .click, .live, .support | 9 | $212.41 | $637.23 |
| Token launch | .com, .io, .xyz, .app, .finance, .network | 6 | $195.94 | $587.82 |
Ten extensions with the most phishing domains, and which ones Wardmint sells
| Extension | Phishing domains | Score | Sold by Wardmint |
|---|---|---|---|
| .com | 869,180 | 53.7 | Yes |
| .top | 375,514 | 596.1 | No |
| .cn | 167,651 | 135.7 | No |
| .pro | 130,945 | 1,200.1 | Yes |
| .info | 99,602 | 189.7 | Yes |
| .xyz | 93,987 | 118.2 | Yes |
| .vip | 83,816 | 501 | No |
| .shop | 79,625 | 202 | Yes |
| .cc | 77,660 | 319.4 | No |
| .icu | 74,786 | 1,607 | Yes |
What is the core set, and why those six?
The core set is .com, .net, .org, .io, .xyz and .app, because it holds the extensions a user would type by hand and the ones a crypto project actually uses. .com is where a mistyped address lands by default. .io and .xyz are common choices for protocols, so a clone on either looks plausible. .app suits a web front end. At $128.94 a year, or $386.82 over three years, it is the least you can do before a public launch.
The individual prices are $12.49/year for .com, $13.49/year for .net, $12.49/year for .org, $59.49/year for .io, $14.99/year for .xyz and $15.99/year for .app. If your project already owns some of them, remove those from the list and keep the rest.
Should a crypto project add finance extensions?
Yes, if it handles funds: .finance, .exchange, .money, .cash, .capital and .fund make a serious-sounding address for a fake. A visitor who reads examplecoin.finance in a message does not find it odd. The set costs $296.94 a year for six names, much more than the core set because the registry prices are higher: .finance alone is $60.49/year. A smaller team can take only the two or three words that match its product, for example .exchange for a trading venue and .fund for a vault. The page on defensive domain registration cost sets these totals against the price of a dispute.
Which endings do phishers use most?
Phishers use .com by volume and cheap new extensions by share: .pro, .info, .xyz, .shop and .icu all sit in Interisle's top ten by count. The "endings phishers use" set holds nine names: .xyz, .pro, .info, .shop, .online, .icu, .click, .live and .support, for $212.41 a year. Five of them are in the table above. The other four were chosen because a word such as .support or .live fits a fake help desk or a fake stream, and Wardmint did not find per-extension counts for them in the data it read.
The scores differ from the counts. .com has 869,180 phishing domains but a score of 53.7, because it is enormous; .icu scores 1,607 and .pro 1,200.1. We do not sell .top, the second on the list, because its price cannot sit under Namecheap's regular renewal. For the data behind this choice, see which domain extensions are most used for phishing.
How many typo variants are enough?
Start with a dozen typos of your main .com and stop where the returns fall. Omit one letter, swap two neighbouring letters, double a letter, and add a hyphen between two words. Then register your name with the usual attack words: login, claim, airdrop, support. A bulk search handles up to 50 names in one go, so the whole list takes one cart. The guide to building a defensive domain list shows how to rank the candidates by what a user would plausibly type.
What does Wardmint's data say about the extensions to buy?
According to Wardmint's survey of 12 November 2026, 6 of the 10 extensions with the most phishing domains in Interisle's data are on sale here: .com, .pro, .info, .xyz, .shop and .icu. Wardmint prices all 29 extensions under Namecheap's regular renewal, by a median of 33%.
A defensive set is a short list of names a project owns so that nobody else can use them against it. The core set of .com, .net, .org, .io, .xyz and .app is the smallest defensive set that Wardmint recommends.
Questions about choosing extensions
Do I need all 29 extensions?
No. Most teams need the core set and two or three finance words that match their product. The rest is for projects with a large user base that a phisher would find worth targeting.
Is .ai worth registering?
For an AI-related project, yes. .ai costs $88.49/year and is sold two years at a time, so the first payment covers two years.
What if the name is already taken under an extension?
Then it is not available to you, and a UDRP complaint is the route if the holder registered it in bad faith against a mark you hold. Check who owns it first, then decide.
Should I register .eth or .crypto names too?
They sit outside the ICANN domain system and Wardmint does not sell them. Register the ICANN extensions first, because that is where browsers and link previews resolve.
Can I add domains after the launch?
Yes. Add them to the cart whenever you see a new look-alike, from the same prepaid balance, at the same yearly price.
In summary
- Core set: .com, .net, .org, .io, .xyz, .app for $128.94 a year.
- Finance words (six names) cost $296.94 a year.
- Endings phishers use (nine names) cost $212.41 a year.
- Token launch set costs $195.94 a year.
- 6 of the 10 extensions with the most phishing domains in Interisle's data are sold here.
- Wardmint does not sell .top; it prices 29 extensions under Namecheap's renewal, median 33% under.
- Add typos and attack words through a bulk search of up to 50 names.
Sources (2)
- Phishing Activity in TLDs, May 2025 to April 2026 — Cybercrime Information Center (Interisle data) (read 2026-11-12)
- Namecheap regular renewal prices, domainoffer.net listing — domainoffer.net (read 2026-11-12)