Claim and airdrop sites
Look-alike domains with your logo and a Connect wallet button, launched the day you announce anything.
Fake claim page and airdrop phishing monitoring for DeFi
One fake claim page can drain your users.
Airdrop, claim and migration pages are the favourite trap in DeFi. FakeWatch spots them when they get an SSL certificate, often before the first victim does.
The scams that target DeFi and DAOs
Wallet drainers
Pages that ask users to sign approvals which empty their wallet in one transaction.
Fake migrations and votes
Posts about a "token migration" or "governance vote" that lead to a phishing page.
What we show you first
- New SSL certificates and domains that use your name
- Wallet connect prompts and known drainer code on fake pages
- Ready reports for the registrar, host and scam blocklists
Read next
-
Domain monitoring
FakeWatch watches Certificate Transparency logs, new registrations and typo variants of your domain, opens each suspicious site and scores the risk.
Read -
Wallet drainers
A wallet drainer is a phishing kit that tricks users into signing approvals or permits. How drainers work, losses in 2023-2025 and how projects fight them.
Read -
Fake airdrop sites
Fake airdrop and claim pages copy a project to make users sign a drainer transaction. How they spread, warning signs, and what projects can do.
Read -
Take down a phishing site
Step by step: find the registrar and host of a fake crypto site, send reports that get acted on, trigger browser and wallet warnings, and escalate to ICANN.
Read
Questions from DeFi and DAOs
Something else? Write to [email protected].
How early can FakeWatch see a fake claim page?
Most phishing sites get an SSL certificate before they go live. On paid plans FakeWatch reads new certificates from Certificate Transparency logs in real time, so a fake can show up before anyone visits it.
Does FakeWatch connect a wallet to the fake site?
No. It opens the page in an isolated browser without a real wallet and looks for wallet connection prompts and known drainer code.
Who gets the takedown report?
The domain's registrar and host, and scam blocklists used by wallets. FakeWatch fills in each report; you send it.
Find out who is using your name today.
Add your project in two minutes. The first scan is free and needs no card or wallet.