Short answer
First warn your community from your official channels and pin one message with your real links. Then save evidence (full URLs, screenshots, account IDs) and report each fake where it lives: the registrar or host for a website, @NoToScam for Telegram, the impersonation form for X, and Discord Trust and Safety. Ask browsers and wallets to block phishing sites, then set up monitoring so you see the next fake before your users do.
Who this is for: Founders, community managers and moderators of a crypto project that just found a fake website, token, channel or account using its name.
Impersonation is the most common attack on a small crypto project. Scammers copy the name, logo and admins, then send users to a fake claim page or a fake support chat. Nothing is wrong with your code; the attack targets your users' trust. The damage depends on how fast your community hears from you.
The first hour
- Warn your community. Post from every official channel: what the fake looks like (write the domain or handle as text, never as a link), what it asks people to do, and that you never DM first or ask for a seed phrase. Pin it.
- Repeat your real links. One message, pinned, with your website, accounts and contract address. Better: one official links page that anyone can check a link against.
- Save evidence before it changes. Full URLs, screenshots with the address bar, account usernames and numeric IDs, wallet addresses the fake asks for, and the time you saw them.
- Send the first reports. One per fake, to the right place (table below). Do not wait to collect every fake first.
Where to report each kind of fake
| The fake is | Report to | Guide |
|---|---|---|
| A website or claim page | Registrar and host; Google Safe Browsing; Netcraft | Take down a phishing site |
| A free subdomain (vercel.app, pages.dev) | The hosting platform's abuse form | Platform contacts |
| A Telegram channel, group, bot or admin | @NoToScam, in-app Report | Report on Telegram |
| An X account | X impersonation form (brand or representative) | Report on X |
| A Discord server, mod or DM | In-app report, dis.gd/report, trademark form | Report on Discord |
| A wallet drainer | MetaMask phishing list, Blockaid, ScamSniffer, Chainabuse | Report to wallets |
The first day
- Look for the rest. One fake is rarely alone. Check registered lookalikes of your domain with our free lookalike checker, search Telegram and X for your name and ticker, and look for tokens with your ticker on DEX screeners.
- Brief your moderators. Give them the evidence folder, the report links and one standard reply for members who ask.
- Follow up. Most abuse desks confirm receipt. If a report gets no answer, reply with new evidence rather than a new ticket.
- Help victims. Point anyone who lost funds to Chainabuse and their local police. For an ongoing drain, SEAL 911 is a free, volunteer emergency line.
The first week
- Close the gaps fakes used. Hide your Telegram member list, add admin titles and block your admins' names in Discord AutoMod. See stop fake admins.
- Make your real links easy to check. Link your official links page from your website, bios and pinned messages.
- Watch for the next one. Scammers re-register within days. Automatic monitoring of new domains, certificates and accounts finds the next fake before your users do.
Mistakes that make it worse
- Posting a clickable link to the fake. Even with a warning, some people click.
- Arguing with the scammer in public. It spreads the fake's name.
- Reporting everything in one long email. Abuse desks handle one domain or account per ticket.
- Waiting for a lawyer. Phishing and impersonation reports need no legal letter.
Sources
- Telegram FAQ (@NoToScam, [email protected])
- X: report impersonation
- Discord: reporting abusive behavior
- ICANN: DNS abuse obligations
- Security Alliance: SEAL 911
Frequently asked questions
Should I post about the fake in my community?
Yes, from your official channels only, and without a clickable link to the fake. Write the fake's name or domain as text, say what it asks people to do, and repeat where your real links are.
Can I get my users' money back?
Rarely. Crypto transfers cannot be reversed. Victims should report to Chainabuse and their local police, and an exchange that received the funds may freeze them if contacted quickly. For a live wallet drain, SEAL 911 runs a free emergency line.
How long does a takedown take?
Platforms such as Vercel or Cloudflare Pages often act within hours. Registrars publish targets from 24 to 72 hours. Browser warnings through Google Safe Browsing can protect visitors before the site goes down.
Do I need a lawyer?
Not for phishing. Registrars, hosts and social platforms act on phishing and impersonation reports from the brand itself. Legal routes such as UDRP or DMCA are for slower cases where the fake is not plain phishing.