How to Identify Fake Crypto Websites and Clone Scams

Identifying a fake crypto website means checking the exact URL character by character, verifying certificate details, and confirming a site through more than one independent source before connecting a wallet or entering credentials — because visual design alone is no longer a reliable signal, since modern clone sites can copy a legitimate interface pixel-for-pixel in minutes.

Fake crypto websites are the delivery mechanism for a large share of phishing and wallet-drainer attacks (see our explainers on crypto phishing and what a crypto drainer is). They're effective because the underlying scam relies on a moment of misplaced trust, and a convincing clone removes almost every visual cue a user might normally rely on to judge legitimacy.

Check the URL character by character

The single most reliable check is the exact domain name, not the page content. Clone sites rely on techniques that look correct at a glance:

• Typosquatting: swapping similar-looking characters or adding/removing a letter (unisvvap.org instead of uniswap.org, or uniswaap.org).
• Homograph attacks: using characters from other alphabets that render visually identically to Latin letters (a Cyrillic "а" instead of a Latin "a"), which can be nearly impossible to spot without zooming in or copy-pasting the URL into a plain text field to inspect the raw characters.
• Subdomain tricks: a URL like uniswap.org.fake-verify.com, where the real brand name appears early in the string but the actual domain is the part right before the top-level domain.
• Alternate top-level domains: the same name on .io, .co, .net, or .xyz instead of the legitimate .org or .com, hoping users won't notice the suffix.

Read URLs right to left from the first single slash to identify the true domain, rather than scanning left to right and stopping once a familiar brand name appears.

Verify through independent channels

Don't trust a link purely because of where you found it — search ads, DMs, and even replies under a real project's own social posts can point to malicious clones. Instead, verify a project's official URL through multiple independent sources: the project's own documentation, a well-established crypto data aggregator, or a source you already trust and bookmarked previously. Once verified, save the correct URL as a bookmark and always navigate to sensitive sites (exchanges, wallets, DEX interfaces) through that bookmark rather than searching or clicking links again.

Inspect the certificate, cautiously

Every legitimate site should use HTTPS, shown as a padlock in the browser bar, but a padlock alone proves almost nothing — obtaining a valid SSL certificate for a scam domain is trivial and free through automated certificate authorities. What's more useful is checking that the certificate was issued for the exact domain you intended to visit (viewable by clicking the padlock), which at least confirms you're on the domain the address bar shows — useful against certain redirect tricks, though it does nothing against typosquatting or homograph domains, which get their own valid certificates too.

Be suspicious of paid search ads

Malicious clone sites have repeatedly bought ads on search engines, sometimes ranking above the genuine project's own site for its exact brand name. Never click a sponsored/ad result for a wallet, exchange, or DeFi protocol — scroll to the organic results, or better, use a saved bookmark you verified previously.

Signals that distinguish real from fake

Signal	Legitimate site	Common clone tell
Domain	Matches exactly, character by character	Off by one letter, wrong TLD, or extra subdomain
Discovery method	Bookmark, official docs, verified aggregator	Search ad, DM link, social media reply
Certificate	Issued for the exact domain	May be valid, but for the wrong domain
Wallet prompts	Clear, expected requests matching your action	Vague "verify" or "claim" requests
Urgency	Rare, informational	Frequent — limited-time claims, warnings

What to do once connected

Even on a confirmed real site, stay alert to what any signature request actually authorizes — a compromised legitimate site (via a hacked plugin or CDN, which has happened to real protocols) can still serve a malicious transaction request. Use a wallet that simulates transactions and explains signatures in plain language, and treat any unexpected or unclear request as a reason to stop, regardless of how you arrived at the site. General DeFi wallet security habits and periodic use of an approval checker reduce the damage even if a fake site briefly slips past your other defenses.

Bottom line

Clone sites can copy everything about a legitimate crypto platform except its exact domain name and how you arrived there. Making URL verification and bookmark-only navigation into a fixed habit — rather than something you only do when a site feels suspicious — closes off the entry point that most phishing and drainer attacks depend on.