How to Check a Crypto Site for Phishing Before You Trust It
Why Checking a Crypto Site for Phishing Matters
Most crypto losses do not start with a broken contract — they start with a convincing website. A fake airdrop page, a lookalike exchange login, or a payment portal off by one character harvests your seed phrase or tricks your wallet into a malicious signature. Checking a site for crypto phishing and scam-domain signs before you ever type a password or connect a wallet catches the trap at the door.
You can do most of this check yourself in a minute. Here is what to look at.
What a Domain Check Looks At
Start from the exact address the link points to (a bare domain, a subdomain or a full URL), not from the words of the link.
Public phishing reports
Look the domain up in public phishing reports. No single list is complete, so a site reported by several independent sources is a strong warning, and a clean result is not proof of safety.
The certificate
Open the certificate in your browser and check who issued it, which name it covers and when it starts and ends. Expired, brand-new or very short-lived certificates are common on phishing sites put up in a hurry.
Look-alike names
Compare the name letter by letter with the address in your bookmarks. A swapped, doubled or look-alike character, or an odd ending on a well-known brand, is a reason to stop.
What to Look For
- Reported by a phishing list: one report is a warning; reports from several independent sources are a reason to stop.
- Certificate problems: expired, brand-new or very short-lived, or issued for a different name.
- A look-alike name or odd ending: a swapped, doubled or look-alike character, or a well-known brand on an unusual ending.
- A site asking you to connect or sign before you did anything: a wallet pop-up the moment the page loads is a common drainer pattern.
Use Cases
Vetting a payment processor. Before a business routes funds or customers through a third-party domain, it can check that no public phishing report names the domain and that its certificate is valid.
Security verifying an airdrop page. Airdrop announcements are a favorite phishing lure. A security operator can check the landing page's reputation and certificate before anyone in the organization connects a wallet to it.
Investigations confirming a malicious frontend. When tracing a scam, investigators check the suspect site's reputation and certificate and record what they found next to the on-chain evidence.
Concrete Benefits
- Catch the attack early. Phishing is stopped before credentials or signatures leave your hands.
- Corroborated verdicts. Several independent reports plus the certificate beat any single blocklist.
- Readable evidence. Which reports name the site, and what its certificate says, are concrete facts you can cite in a report.
Build a Layered Defense
Checking the domain is one layer of a broader anti-fraud posture. Pair it with a scam-address check to connect a bad site to the wallets it feeds, fold both into your self-custody security routine, and when a site does push a transaction at you, simulate it before signing so a malicious signature never lands.
Check the Link Before You Trust It
A minute spent checking a domain is cheaper than a drained wallet or a compromised customer. Make it a reflex: open sites from your own bookmarks, and check any new link before you type a password or connect a wallet.