A phishing URL is a web address that looks like a legitimate crypto protocol but is controlled by an attacker. Connecting your wallet to it or signing any transaction from it can drain every token you own. The direct answer: verify the domain by typing it yourself from a saved bookmark, never from a link. Check the domain on Web3defender’s URL scanner before connecting anything.

How phishing URLs are constructed

Attackers have six main techniques for creating convincing fake domains:

Typosquatting

Register a domain one character off from the real one. Users who mistype or skim the URL land on the fake.

  • uniswap.org vs uniswop.org
  • opensea.io vs opensea.io.mint-claim.com (subdomain attack)
  • metamask.io vs metamask-io.com

Homograph attacks

Unicode includes characters that look identical to ASCII letters. An attacker registers a domain using a Cyrillic “a” (looks exactly like Latin “a”) in an otherwise English domain name. The URL looks correct but points to a different server. Browsers with Unicode normalization protection show the punycode version, but not all do.

Subdomain abuse

The real domain is present, but it is a subdomain of the attacker’s domain: app.uniswap.org.drainer-site.com

The real domain uniswap.org appears in the URL. It is not the domain - it is a subdomain label. Only the last two parts of the URL (before the first /) form the actual domain. Everything before that is a subdomain.

Combo squatting

Adding words to a legitimate brand:

  • uniswap-airdrop.com
  • metamask-security-alert.com
  • opensea-nft-claim.io

These domains often rank in paid search results above the real protocol.

Brand-new domains

Legitimate DeFi protocols are years old. A site with a domain registered this week claiming to be an established protocol is almost certainly fake. Check domain registration date via WHOIS lookup.

Compromised legitimate sites

In some cases the real domain is used. Attackers compromise the DNS records or the CDN serving the front-end JavaScript. Visitors reach the correct URL but receive malicious code. This happened to several major DeFi front-ends in 2024. A URL scanner alone cannot catch this - the domain is correct and the SSL certificate is valid.

Search engine ads

Attackers buy Google and Bing ads targeting queries like “uniswap,” “metamask download,” and “opensea.” The ad appears above the organic search result and links to a fake domain. The ad display URL is often faked to show the real brand name.

Do not click search ads to reach crypto protocols. Type the URL or use a saved bookmark.

Twitter and X

Compromised high-follower accounts post “exclusive airdrop” links. Attackers compromise accounts by targeting the email behind them or buying compromised credentials. A post from a verified account with 200,000 followers linking to a “free NFT mint” is not automatically safe - check whether the account has ever posted about this topic before, and verify the URL.

Discord DMs and server posts

Scammers join Discord servers for legitimate projects and DM members with “you’ve been selected” messages. They also post in announcement channels after compromising a moderator account. Legitimate projects never DM first and never require you to click a link to claim something.

Telegram

Both public channels and direct messages carry phishing links in crypto Telegram. Bots send messages claiming your wallet is “about to be deactivated” or that you have unclaimed funds. These messages include a link and often create urgency.

Email

Phishing emails impersonate exchange support, wallet software, or DAO governance notifications. They use sender addresses that look similar to the real ones (security@metamask-alert.io instead of an actual MetaMask address). Legitimate wallet software does not email you to ask you to “verify” your seed phrase.

How to verify a URL before connecting

Step 1: Read the actual domain. Identify the real domain: the part immediately to the left of the TLD (.com, .io, .org). Ignore subdomains. app.uniswap.org - real domain is uniswap.org. app.uniswap.org.drainer.com - real domain is drainer.com.

Step 2: Check the SSL certificate. Click the padlock in the browser. The certificate common name should match the expected domain. SSL alone is not security - attackers get SSL certificates for their fake domains too - but a mismatch is an immediate stop.

Step 3: Scan the URL. Paste the URL into Web3defender’s URL scanner. It checks the domain against GoPlus phishing databases updated continuously with reported scam sites. A clean result reduces risk; it does not eliminate newly registered domains that have not been reported yet.

Step 4: Check domain age. Use a WHOIS tool to check when the domain was registered. A protocol claiming to be two years old but with a domain registered last week is a fake. Major DeFi protocols have domains registered years before you heard of them.

Step 5: Navigate directly. Close the current tab. Open a new tab. Type the domain yourself or select from your browser’s bookmarks. Connect your wallet only after you have arrived at the expected URL via a trusted navigation path.

What a URL scanner detects and what it misses

A URL scanner checks domains against known phishing databases and heuristic patterns (keyword combinations that match phishing templates, domain age, domain registration country).

It detects:

  • Known reported phishing domains.
  • Newly registered domains matching phishing patterns.
  • Domains with brand names plus high-risk keywords (“claim,” “airdrop,” “mint,” “free”).

It does not detect:

  • Compromised legitimate domains (the real URL with injected malicious code).
  • Zero-day phishing domains registered within the last few hours and not yet reported.
  • Social engineering that does not involve a URL (phone calls, DMs asking for seed phrases directly).

What is never legitimate

Three things that legitimate crypto services never do:

  1. Ask for your seed phrase. Ever. By any channel. For any reason. Your seed phrase is never entered into a website.
  2. Require you to send crypto to “verify” your wallet or “activate” a feature. No legitimate service requires an incoming payment to unlock a feature you already have.
  3. Message you first about a security issue and then ask you to connect your wallet through their link. Go to the official site yourself.

FAQ

Does a green padlock (HTTPS) mean a site is safe? No. HTTPS means the connection is encrypted, not that the site is legitimate. Phishing sites routinely have valid SSL certificates. The padlock tells you nobody intercepted your traffic; it says nothing about where your traffic is going.

Can phishing sites be taken down quickly? Legitimate registrars and hosting providers respond to abuse reports, and many phishing domains are taken down within 24-72 hours. Attackers compensate by registering multiple domains and rotating them. A domain that was a phishing site yesterday may already be replaced.

What if I already connected my wallet to a suspicious site but did not sign anything? Connecting your wallet (sharing your address) does not by itself drain you. The risk comes from signing transactions or messages. If you connected but signed nothing, audit your approvals immediately using Web3defender’s approvals scanner and revoke anything added around that time.