How to spot a fake crypto website

Every fake crypto site we've documented on the blacklist — cloned Ledger Live download pages, giveaway pages, "support" portals — followed the same playbook: look exactly like the real thing, arrive at exactly the right moment, and rush you past the moment of doubt. The defense isn't paranoia; it's a fixed routine you run every single time you're about to type a seed phrase, connect a wallet, or enter a password.

Why fake sites work

Phishing is an attention attack, not a technical one. The page is pixel-copied from the real site; the certificate padlock is real (anyone can get one for any domain); and the delivery is timed — a text message about "unusual activity" right after a real exchange outage, a "wallet migration" email during actual news. None of this requires you to be careless. It requires you to be busy, which is permanent. That's why the answer is a routine, not vigilance: check the same five things, in the same order, every time, and let habit do the work willpower can't.

The five-minute inspection routine

1. Read the domain backward. Registrable domain is the part just before the first single slash — in ledger.com.verify-wallet.net/login it's verify-wallet.net, not the flattering word before it. Hyphens, extra words and wrong TLDs (.io for .com, .co for .com) are the classic tells. Check character by character against the real name: rn/m and l/I substitutions are deliberate.
2. Check how you got there. If the link came from an email, SMS, Discord DM or a YouTube comment — treat it as hostile until proven otherwise. Type the company's domain yourself or use a bookmark you saved long ago. No legitimate wallet company will ever DM you first.
3. Check the domain's age. A "since 2014 exchange" whose domain was registered three weeks ago has a documented history of lying. WHOIS lookups take thirty seconds and are the single most damning check on cloned stores.
4. Verify the trust seals the honest way. Audit badges and regulator footers link to the auditor or register — fake sites link to an image, or to a clone of the verifier. Open the link in a new tab and confirm it lands on the real auditor's domain, not on a cousin of the site you're checking.
5. Check the app trail. Any site pushing a wallet app should link the official store listing from the vendor's real domain — and that listing's developer name, install count and review history should match what the vendor's own site claims. The fake-store pattern is documented extensively in our scam case files.

Three clone patterns to know on sight

• The download clone. A pixel-perfect copy of a wallet vendor's download page. The "download" button serves malware or a seed-harvesting app. Real vendors' software is always reachable by typing the vendor's domain directly — Ledger, Trezor and friends state this constantly because the attack keeps working.
• The giveaway page. A livestream or landing page promising to double any deposit "sponsored" by a famous face, often deepfaked. The math is the tell: no entity needs your 0.2 ETH to give you 0.4. These networks rotate domains weekly, as covered in our case files.
• The support portal. You search a problem, a paid ad or SEO result surfaces a fake support number or chat. "Support" asks for your seed phrase "to restore access". Real support never needs your seed phrase — that sentence alone kills this entire category.

Automate the check

Habits fail on bad days, so remove the human step where you can. Bookmark the domains you use and let your password manager's autofill do the verifying — it fills credentials only on the exact domain where they were saved, so an empty autofill on a "login" page is itself an alarm. If you build anything with a web surface, check names against the Kunch blacklist programmatically; one call returns the full record with sources:

curl https://api.kunch.shop/v1/domains/suspect-domain.net \
  -H "Authorization: Bearer kn_live_your_key_here"

The API documentation covers bulk checks and the free tier. And when you find a fake the database doesn't know about yet, report it — the entire point of the pipeline is that your find protects the next person.

If you already typed something

If you entered a seed phrase or recovery words into any site you now doubt: that phrase must be considered compromised the moment it touched that page. Generate a new wallet with a new seed, move funds to it from a device you trust, and only then deal with cleanup. If you signed a transaction you didn't understand, revoke token approvals where applicable and move remaining assets. If you only visited and typed nothing, you're almost certainly fine — close the tab, clear nothing in a panic, and run the routine above. Speed matters most in the first case, which is why the routine exists: the cheapest time to be suspicious is before the keystroke.

A padlock icon means the connection is encrypted — to whoever owns the page. Criminals buy certificates too. It has never meant "this site is honest."