How to Spot a Phishing Clone Website

The most successful crypto thefts rarely involve breaking cryptography. They involve convincing you to do the stealing yourself, on a website that looks exactly like one you trust. A phishing clone is a pixel-for-pixel copy of a real wallet, exchange, or DeFi site, hosted on a domain that is almost, but not quite, the real one. Its goal is to capture your credentials, your seed phrase, or, increasingly, a malicious signature that lets an attacker drain your wallet. Because the page is a faithful copy, your eyes will not save you. A short, repeatable verification routine will.

What a phishing clone is trying to get

Clone sites pursue one of three prizes, and the defenses differ slightly for each:

• Your seed phrase. A fake “wallet validation,” “sync,” or “recovery” prompt asks you to type your 12 or 24 words. A legitimate wallet never asks for your seed phrase on a website — the seed is entered only inside the wallet app itself, during setup or a deliberate restore. Any web page requesting it is a scam, full stop.
• Your login credentials. A fake exchange login captures your username, password, and even a one-time code, which the attacker relays to the real site in real time. This is why phishing-resistant hardware-key 2FA matters so much on exchange accounts.
• A malicious signature. The most modern clones do not ask for secrets at all. They ask you to connect your wallet and sign a transaction or approval that hands the attacker permission to move your tokens. Understanding how wallet drainers work shows why a single careless click can empty a wallet.

How you end up on a clone

Clones do not appear by accident; you are steered to them. Common vectors include search-engine ads impersonating a brand, links in phishing emails and direct messages, fake support accounts on social media, malicious QR codes, and even address poisoning transactions that plant a lookalike link in your history. The one thing these have in common is that you arrived by clicking. The single most effective habit is to reach sensitive sites only through your own saved bookmark, never through a link someone gave you.

How to spot a phishing clone

Run this checklist before you type, connect, or sign anything. Any single failure is enough to walk away.

Inspect the domain character by character

Read the full domain in the address bar slowly, from the right. Attackers register lookalikes using swapped letters, extra words, or different endings — for example a hyphenated variant, a .app or .net in place of the genuine .com, or a subdomain crafted so the brand appears in the wrong position. Watch for homoglyphs, where a character from another alphabet mimics a Latin letter. The brand name appearing somewhere in the URL means nothing; only the real registered domain, immediately to the left of the top-level domain, matters.

Do not trust the padlock alone

The HTTPS padlock only means the connection is encrypted, not that the site is genuine — anyone can obtain a certificate for a lookalike domain. Treat the absence of HTTPS as a clear red flag, but never treat its presence as proof of legitimacy.

Refuse any request for your seed phrase

No legitimate website ever needs your recovery phrase. If a page, pop-up, or “support agent” asks you to enter it to validate, sync, migrate, or unlock your wallet, it is a theft attempt. Close the tab.

Scrutinize connect and signature prompts

When a site asks you to connect a wallet or sign, read what you are approving. Be especially wary of broad token-approval or “set approval for all” requests and of signatures you do not understand. If in doubt, reject and investigate before signing.

Sanity-check the surrounding signals

• Urgency and pressure (“act now or lose access”) are hallmarks of phishing.
• Unsolicited “you have a reward/airdrop, connect to claim” prompts are classic bait.
• Broken links, odd support channels, and brand-new domains are warning signs.
• Cross-check the official URL from an independent source, and beware fake customer support — see fake support scams.

How clones get in front of you: typosquatting and ad abuse

It helps to know the supply chain behind a clone. Attackers register domains that are one keystroke or one lookalike character away from the real one — a practice called typosquatting — so that a mistyped URL or a hurried glance lands you on their copy. They also buy search-engine and social-media ads that impersonate a brand, sometimes appearing above the genuine result. Because the ad’s display text can show the real brand while the click destination is the clone, ranking or position in search is not evidence of legitimacy. This is why a bookmark beats a search every time: a bookmark you saved from the verified site cannot be outbid or outranked by an impostor.

Another modern twist is the fake “wallet connect” or “revoke/claim” portal advertised as a security tool. It poses as a helpful service — sometimes even claiming to protect you — but the connection or signature it requests is the attack. Legitimate approval management is something you do from tools you already trust; when in doubt about permissions you have granted, reach a genuine approval-management tool through channels you verified independently rather than through an ad.

Verify the app and extension too

Clones are not limited to web pages. Fake wallet apps in app stores and malicious browser extensions impersonate real products, sometimes with fake reviews and inflated download counts. Confirm you are installing the genuine product before you ever enter a secret; our guide on how to verify a wallet app is genuine covers the checks. The broader security hub connects these habits.

Reading a signature request before you approve

Because the most dangerous clones ask for a signature rather than a secret, learning to read a signature prompt is now a core skill. When your wallet pops up a request, slow down and ask what type it is. A plain message signature that just proves you own an address is usually low-risk. The requests to fear are those that grant spending power: a token approval that lets a contract move a specific token, an unlimited approval that removes any cap, and setApprovalForAll, which can authorize a contract to move every item in an NFT collection you own. Structured EIP-712 data and gasless “permit” signatures can grant the same power without an obvious on-chain transaction, which is exactly why drainers favor them.

Modern wallets try to help by showing a human-readable summary and warnings for known-malicious sites, but these aids are not infallible. The reliable rule is conservative: if you did not intend to grant spending access, and the prompt would do so, reject it. If a site insists you must sign something unusual just to view a page, claim a reward, or “verify” your wallet, that insistence is itself the red flag.

Genuine site versus clone: what actually differs

No single row is the whole story, but any clear mismatch is reason enough to stop. The genuine site earns trust through the domain and the nature of its requests, never through how convincing it looks.

One more habit closes the loop: use a dedicated browser profile, or even a separate device, for anything involving significant funds, and keep it free of unrelated extensions and casual browsing. A clone can only harm you if you interact with a wallet that holds value, so isolating your high-value activity from everyday clicking shrinks the blast radius of any single mistake.

If you already entered something

Act immediately, and match the action to what you exposed:

• You typed a seed phrase or private key: the wallet must be considered permanently compromised. Create a brand-new wallet with a new seed on a clean device and move any remaining funds there at once.
• You entered exchange credentials: change the password, revoke active sessions, and strengthen 2FA; contact the exchange if you cannot regain control.
• You signed a connection or approval: review and revoke token approvals for that wallet without delay, and move funds if the wallet still holds them.

A full walkthrough is in wallet compromised: what to do. Because on-chain transfers and granted approvals can be exploited within minutes, minutes matter. The safest position, though, is never to reach the clone in the first place: bookmark the real sites, verify the domain every time, and never enter a seed phrase into a web page.

Sources

• How to Recognize and Avoid Phishing Scams — U.S. Federal Trade Commission
• Recognize and Report Phishing — U.S. Cybersecurity and Infrastructure Security Agency (CISA)
• Staying Safe in Web3 — MetaMask Support
• Understanding Token Approvals — Revoke.cash