Most crypto theft does not involve breaking into a wallet at all. It involves getting someone to visit a site that looks correct, connect their wallet, and sign something they should not have. A huge share of that starts with a web address that is almost, but not quite, the real one.
This article covers how lookalike and typosquatted domains are built, why they can be hard to catch with a quick glance, and a short set of habits that remove almost all of the risk.
What typosquatting actually is
Typosquatting means registering a domain name that is a small variation of a real one, betting that some visitors will type it, click it, or glance at it without noticing the difference. Common patterns include:
- Swapped or doubled letters: uniswapp.org instead of uniswap.org, or basescann.org instead of basescan.org.
- Added or removed characters: simplebase-swap.com instead of simplebaseswap.com.
- Different top level domains: the same name under .net, .io, .xyz, or .app instead of the official .com.
- Extra subdomains designed to confuse: something like simplebaseswap.com.verify-wallet.io, where the real brand name appears early in the string but the actual domain is the part after the last dot.
None of these require any special skill. A scammer can register dozens of close variants of a popular wallet, exchange, or dapp name for a small fee and point each one at a cloned front end.
Homograph attacks: when the letters are not even Latin
A more technical version of the same idea uses characters from other alphabets that render as near identical shapes. A Cyrillic "а" can look indistinguishable from a Latin "a" in most fonts, so a domain can be spelled with a mix of scripts and still look exactly right on screen. Browsers handle this by converting those domains into a coded form, called Punycode, that starts with "xn--" when the address actually contains non Latin characters. The problem is that many browsers will instead display the decoded, human readable version in the address bar, which is the version designed to fool you in the first place.
This means a glance at the address bar is not always enough. If something about a site feels off, a more reliable check is to select the address bar text and look at the raw characters, or paste the URL somewhere that will show it in plain text rather than a rendered font.
Why this works even on experienced users
Lookalike domains are effective for a few practical reasons that have nothing to do with how careful someone normally is:
- Search ads and sponsored results. A fake site can pay to appear above the real one in search results for a brand name, so the first link someone clicks is not always the correct one.
- Social media links. A convincing post, comment, or ad with a slightly wrong domain spreads faster than it gets reported and taken down.
- Cloned interfaces. Copying the HTML, CSS, and images of a real site takes very little effort, so the fake page can be pixel for pixel identical to the one it is imitating.
- Urgency. Messages about a limited time airdrop, a security issue that needs immediate action, or a migration deadline push people to click quickly instead of checking the address first.
A wallet itself cannot tell the difference between a real dapp and a convincing fake one. It will happily connect to either, and it will present a signature request from either exactly the same way. The decision about which site to trust has to happen before the wallet gets involved.
How to check you are on the real site
- Type the address yourself, or use a bookmark you created earlier. Do this once, from the project's own social accounts or documentation, and reuse that bookmark going forward instead of searching for the name each time.
- Read the full domain, right to left from the last dot. Only the part immediately before the top level domain (.com, .io, and so on) is the actual domain. Everything before that can be written to say anything.
- Check for the padlock and the certificate, but do not rely on it alone. A valid certificate only confirms the connection is encrypted, not that the site is legitimate. Fake sites can and do have valid certificates.
- Watch what a password manager does. If you use one, it will only offer to fill in a saved credential on the exact domain it was saved for. If it stays silent on a page that looks like a site you have used before, that is a signal worth stopping for.
- Confirm unusual requests through a second channel. If a link arrives claiming urgency, such as a migration, a hack warning, or a limited time claim, check the project's official account or documentation directly rather than trusting the link itself.
- Be more careful on mobile. Smaller screens truncate URLs and make small spelling differences harder to spot, which is exactly why many lookalike campaigns are built around links shared in messaging apps rather than desktop browsers.
Where this fits with Simple Base Swap
Simple Base Swap only ever interacts with your wallet through requests you approve one at a time, and it never asks for a recovery phrase on any page. The habit that actually protects you is the same regardless of which app you are using: confirm the domain before connecting a wallet or signing anything, every time, even on a site you believe you have visited before. A few seconds of checking the address bar is far cheaper than recovering from a transaction signed on the wrong site.