What is typosquatting?

Typosquatting is when an attacker registers a domain that is nearly identical to a legitimate one — often with a single character changed, replaced with a lookalike (rn vs m), or a different TLD (.net instead of .com). For example, 'uniswap.oom' or 'metamásk.io' (with an accented á).

Does HTTPS mean a website is safe?

No. HTTPS (the padlock icon) only means the connection between your browser and the server is encrypted. It says nothing about whether the server itself is legitimate or controlled by an attacker. Phishing sites can and do use HTTPS with valid certificates.

What is a Whois lookup?

Whois is a public database of domain registration information. You can look up when a domain was registered, who registered it (sometimes anonymised), and what registrar was used. Legitimate crypto projects typically have long-established domains. A 2-week-old domain claiming to be a major protocol is a major red flag.

How do I verify the correct URL for a crypto project?

Go to the project's official Twitter/X, GitHub, CoinGecko page, or CoinMarketCap listing, and click the website link from there. Legitimate projects list their official URLs on these third-party platforms. Avoid clicking links from search engine ads or DMs.

Security · Scam Detection

How to Identify a Fake Crypto Website

Modern phishing sites are visually indistinguishable from the real thing. These seven checks take under two minutes and will catch the vast majority of fakes before you connect your wallet.

By Ashir Khan3 min read

Ashir Khan writes about cryptocurrency security, self-custody, macro market analysis, and regulatory policy at CryptoBeacon.

Last updated: September 1, 2026

The seven checks

Inspect the full URL character by character

Check the domain name letter by letter. Look for lookalike characters: 'rn' (r+n) vs 'm', 'vv' vs 'w', '0' vs 'o', accented letters (á, ë). Also check the TLD — .com, .io, .org, .net all look similar in quick scanning.

Verify the domain age via Whois

Use whois.domaintools.com or a similar tool. Legitimate protocols have domains registered years ago. A 2-week-old domain claiming to be Uniswap or Aave is definitively fake, regardless of how good it looks.

Check the SSL certificate issuer

Click the padlock icon → 'Connection is secure' → 'Certificate is valid'. Legitimate major sites often use OV (Organisation Validated) or EV (Extended Validation) certificates showing the company name. Note: HTTPS alone is not proof of legitimacy.

Cross-reference with CoinGecko or CoinMarketCap

Major token and protocol pages on CoinGecko and CoinMarketCap list the official website. Navigate to the site via these links rather than following search results or third-party links.

Verify the URL via the project's official social accounts

Check the project's verified Twitter/X, Telegram, or Discord for the official URL. Be careful: fake accounts also exist. Verified marks and follower counts help, but cross-check across multiple platforms.

Always verify pasted wallet addresses

Clipboard hijacking malware replaces copied addresses with attacker addresses. After pasting any address, check the first 6 and last 6 characters against the original. Many hardware wallets display the destination address on-screen for independent verification.

Check for search engine ads

Never click paid search results (labelled 'Sponsored' or 'Ad') for crypto sites. Attackers buy ads for keywords like 'MetaMask' or 'Uniswap' that link to identical-looking phishing sites. Always scroll past ads to organic results or use bookmarks.

The best protection: bookmarks

The single most effective habit against fake crypto websites is using browser bookmarks for every site you regularly use. When you are already on the legitimate site, bookmark it. Never navigate to DeFi sites, exchanges, or wallet providers by searching — always use your bookmarks.

This eliminates the risk of typosquatting, poisoned search results, and paid ads entirely for your regular sites.