Skip to main content
Category: Hacks → Phishing & TyposquattingHacksPhishing & TyposquattingReading time: 8 minutes
Risk level: High
Target audience: All crypto users, especially those connecting wallets to websites

​
What Is Typosquatting?

Typosquatting (also called URL hijacking) is registering domain names that are nearly identical to legitimate websites, relying on small typos or visual similarities to trick users into visiting fake sites. In crypto, typosquatted domains are the #1 delivery mechanism for phishing attacks and wallet drainers.

​
Examples:

The difference might be a single character—easy to miss when you’re in a hurry or on mobile.

​
The Anatomy of a Typosquat Attack

​
Phase 1: Domain Registration

When: Immediately after a new crypto project, exchange, or protocol launches How:
  • Scammers monitor announcements on Twitter, Discord, ProductHunt
  • Within hours, they register dozens of typosquatted variants
  • Cost: $10-$50 per domain
  • Profit potential: Thousands to millions per successful campaign
Example: When ChatGPT launched, over 600 typosquatted domains were registered within the first month.

​
Phase 2: Website Cloning

What they copy:
  • Exact HTML/CSS from the real site
  • Logos, branding, color schemes
  • Layout and user flow
  • Even SSL certificates (HTTPS doesn’t mean safe!)
What they change:
  • Wallet connection code → points to drainer contract
  • Form submissions → send data to attacker
  • Download links → serve malware instead of legitimate apps
Time to clone: 1-4 hours with automation tools

​
Phase 3: Traffic Generation

How users end up on fake sites:
  1. Organic typos - Users mistype URLs directly in browsers
  2. Phishing emails - Fake notifications with typosquatted links
  3. Social media ads - Paid promotion on Twitter, Facebook, Google
  4. Discord/Telegram DMs - Fake support sending malicious links
  5. Search engine poisoning - Fake sites ranking high for slight misspellings
Example traffic path:
  • User googles “metamask wallet”
  • Clicks sponsored link (paid ad from scammer)
  • Goes to metamaask.io instead of metamask.io
  • Connects wallet → drainer executes

​
Phase 4: The Attack

Variant 1: Wallet Drainer
  • User connects wallet to fake site
  • Site requests malicious approval
  • Wallet is drained within seconds
Variant 2: Credential Phishing
  • User enters exchange login credentials
  • Attacker captures username/password/2FA
  • Account is later drained
Variant 3: Malware Distribution
  • User downloads “official wallet app”
  • Actually downloads malware/fake wallet
  • Seed phrase is stolen when user sets up wallet

​
Common Typosquatting Patterns

​
1. Character Substitution

Pattern: Replace letters with visually similar ones

​
2. Homoglyph Attacks

Pattern: Use characters from different alphabets that look identical Examples:
  • аmazon.com - The “а” is Cyrillic, not Latin
  • аpple.com - Cyrillic “а”
  • googlе.com - Cyrillic “е”
Why it’s dangerous: Visually indistinguishable from the real domain.

​
3. Missing or Extra Characters

Pattern: Add/remove letters

​
4. Hyphenation & Punctuation

Pattern: Add hyphens or dots where they don’t belong
  • meta-mask.io (real: metamask.io)
  • coin.base.com (real: coinbase.com)
  • uni-swap.org (real: uniswap.org)

​
5. TLD (Top-Level Domain) Variations

Pattern: Use different endings Example: uniswap.org is real, but uniswap.com could be a scam.

​
6. Subdomain Tricks

Pattern: Put the real domain in a subdomain
  • coinbase.scam-site.com (looks like “coinbase” but isn’t)
  • https://metamask.io.fake-wallet.com
Why it fools people: The real brand name appears in the URL, but it’s not the actual domain.

​
Case Studies

​
Case Study 1: The Uniswap Phishing (2023)

What happened:
  • Scammers registered uniswwap.org (extra “w”)
  • Cloned the real Uniswap interface
  • Ran Google Ads targeting “Uniswap” searches
  • Users connected wallets, approved malicious contracts
  • Estimated losses: $500,000+ before shutdown
Red flag users missed: The double “ww” in the URL

​
Case Study 2: MetaMask Fake Extension

What happened:
  • Fake “MetaMask” extension uploaded to Chrome Web Store
  • Name: “MetaMask” (identical)
  • Icon: Identical to real extension
  • Downloaded by 10,000+ users before removal
  • All seed phrases entered were sent to attackers
How it worked: Used typosquatted publisher name and similar extension ID

​
Case Study 3: The Ammatina Grant Scam (Lisa’s Story)

What happened:
  • Real grant program: ammatina-funds.com
  • Typosquat: arnrnatina-funds.com (double “r”, missing “i”)
  • Email phishing campaign targeted grant applicants
  • Victims connected wallets to fake claim portal
  • Individual losses: $50,000-$200,000 per victim
Full story: Grant Phishing: Lisa’s $180,000 Lesson

​
How to Protect Yourself

​
Before Visiting ANY Crypto Site

1

Type URLs Manually or Use Bookmarks

Never click links in emails, DMs, or social media for important sites. Type them directly into the browser or use saved bookmarks.Pro tip: Create a “Crypto - Verified” bookmark folder with all your important sites the FIRST time you verify them.
2

Verify Character-by-Character

Before hitting Enter, examine the URL:
  • Count letters (uniswap = 7 letters, not 8)
  • Check for hyphens or dots that shouldn’t be there
  • Verify the TLD (.io vs .com vs .org)
  • Look for subtle character swaps
3

Use Browser Security Extensions

Install anti-phishing tools:
  • MetaMask - Has built-in phishing detection
  • Wallet Guard - Browser extension that warns about scam sites
  • Google Safe Browsing - Built into Chrome/Firefox
  • Netcraft Extension - Phishing protection
4

Check Domain Age and Registration

Use WHOIS lookup tools:Red flags:
  • Domain registered within last few weeks/months
  • Privacy protection hiding owner info
  • Registration date doesn’t match project launch date
5

Verify SSL Certificate Details

Click the padlock icon in the browser:
  • Check the certificate is issued to the right company
  • Verify the domain exactly matches
  • Look for extended validation (EV) certificates (show company name)
NOTE: HTTPS/SSL does NOT mean safe—scammers get certificates too!

​
Red Flags Checklist

  • URL came from an email, DM, or unsolicited message
  • Domain has extra/missing/different letters when compared to official
  • TLD is different (.com instead of expected .io)
  • Domain has hyphens or dots in unexpected places
  • Site appeared in sponsored search results (ads, not organic)
  • WHOIS shows domain registered very recently
  • Site asks you to connect wallet immediately without clear context
  • SSL certificate shows different company name than expected
  • Site has no “About,” “Team,” or “Contact” pages (just the main function)

​
Tools & Resources

​
Domain Verification

WHOIS Lookup

Check domain registration details:

URL Scanners

Scan suspicious URLs before visiting:

SSL Checkers

Verify certificate details:
  • SSL Labs
  • Browser padlock → cert details

Phishing Databases

Check if URL is known scam:

​
Browser Extensions

  • MetaMask - Built-in phishing detection for crypto sites
  • Wallet Guard - Real-time scam site warnings
  • Netcraft Extension - Phishing and fraud protection
  • uBlock Origin - Ad blocker (prevents malicious ads)

​
Real-World Statistics

6,000+ Typosquats

Over 6,000 typosquatted domains targeting Amazon alone have been identified.Source: CYFIRMA Research

600+ in First Month

ChatGPT had over 600 typosquatted domains registered within the first month of launch.Source: Domain monitoring services

#1 Phishing Vector

Typosquatting is the most common delivery method for crypto phishing attacks.Source: Security research firms

$100M+ Annual Losses

Estimated annual losses to typosquatting-based crypto scams exceed $100 million globally.Source: Blockchain forensics analysis

​
What to Do If You Visited a Fake Site

1

If You Connected Your Wallet

IMMEDIATELY:
  1. Visit Revoke.cash
  2. Revoke ALL approvals from the suspicious contract
  3. Create a new wallet with fresh seed phrase
  4. Transfer remaining assets to new wallet
2

If You Entered Credentials

IMMEDIATELY:
  1. Change password on the REAL site (typed manually)
  2. Enable/reset 2FA
  3. Check for unauthorized login sessions and terminate them
  4. Monitor account for suspicious activity
3

If You Downloaded Software

IMMEDIATELY:
  1. Do NOT run the downloaded file
  2. Run full antivirus/malware scan
  3. If you already installed it, disconnect from internet and seek malware removal help
  4. Create new wallets and transfer funds (assume seed phrases compromised)
4

Report the Fake Site

Help protect others:
  • ChainAbuse - Report the address/URL
  • Google Safe Browsing - Report phishing site
  • PhishTank - Community phishing database
  • Twitter - Report the account/tweet that linked to it

Grant Phishing + Drainer

Real story of typosquatting leading to $180K loss

NFT Mint Drainer

How fake NFT project sites use drainers

Hacks Category

Explore all phishing and wallet drainer attacks

Check Your Wallet

Verify if addresses/domains are reported

​
Key Takeaways

  1. Always type important URLs manually or use bookmarks—never click links in emails/DMs
  2. Examine URLs character-by-character before hitting Enter or connecting wallets
  3. HTTPS/SSL does NOT mean safe - Scammers get certificates too
  4. Use security extensions that warn about known phishing sites
  5. When in doubt, pause - There’s no rush worth risking your funds
Remember: Scammers rely on speed and distraction. Slow down, verify, and protect yourself.

​
References

  1. Trust Wallet - Typosquatting in Crypto Explained
  2. CYFIRMA - Typosquatting Unmasked
  3. Kaspersky - What is Typosquatting?
  4. Proofpoint - Phishing Schemes Target Cryptocurrency
  5. Telefonica Tech - Typosquatting Detection and Protection