How crypto impersonation scams work

Learn

• Crypto impersonation scams

  How scammers copy crypto projects: lookalike domains, fake Telegram admins, cloned X accounts, fake tokens and airdrops. With 2025 loss figures and sources.

  Read

• Lookalike domains

  Lookalike domains copy a real domain with typos, swapped letters, other TLDs, extra words or Unicode characters. How each type works and how to find them.

  Read

• Typosquatting vs cybersquatting

  Typosquatting is a misspelled domain; cybersquatting is any bad-faith registration of a trademark as a domain. Definitions, the UDRP test and examples.

  Read

• Certificate Transparency

  Every public HTTPS certificate is logged in Certificate Transparency logs. How the logs work, why Chrome requires them, and how they reveal new fake domains.

  Read

• Homoglyph domains

  Homoglyph domains swap Latin letters for look-alike Cyrillic or Greek ones. How punycode (xn--) works, what browsers show, and how to detect these fakes.

  Read

• Wallet drainers

  A wallet drainer is a phishing kit that tricks users into signing approvals or permits. How drainers work, losses in 2023-2025 and how projects fight them.

  Read

• Fake airdrop sites

  Fake airdrop and claim pages copy a project to make users sign a drainer transaction. How they spread, warning signs, and what projects can do.

  Read

• Address poisoning

  Address poisoning plants a lookalike address in a wallet's history so the victim copies it. Mechanism, scale (270M attacks) and simple defences.

  Read