How to check a crypto site address

The address bar is the name of the site

A phishing page is a copy of a login, a wallet connect screen, or a claim form, hosted on a name the real company does not own. The page can use the real logo, the real colours, and the real wording. The part it cannot keep, if you look, is the domain at the end of the host you are actually connected to. Everything else on the page is content the site owner chose to display, including pictures of a padlock.

This page is about reading that host before you type a password, scan a QR code with a wallet, or approve a connection. It is not a list of live fake domains, and it does not explain how to register one, buy an ad for one, or obtain a certificate. Those are the attack. The check below is the same check for an exchange, a wallet download, a bridge, and an airdrop claim.

Which part of the URL is the owner

Read the host from right to left, stopping at the registrable name. In a host like support.example.com the owner is example.com. The word support is a label the owner of example.com attached. Anyone who controls example.com can attach any label they want. A host like example.com.attacker.example is owned by attacker.example. The familiar name sitting on the left is a folder, not the company.

A path does not change the owner. example.com/login and example.com/anything-else are the same site. A query string, the part after a question mark, is data the site receives. It is not a second domain. Ignore the long tail when you are deciding who you are talking to. Look at the host.

Internationalized names can use letters that look like Latin letters and are not. A domain can also use a doubled character, a hyphen, or an extra word such as 'support' or 'secure' glued to a brand. You do not need a catalogue of those tricks if you already know the exact host and you refuse to proceed when the host is merely similar. Similarity is the whole product. The exact string is the check.

The padlock means the connection is encrypted

HTTPS means the browser is talking to the host in the bar over a connection that a network in the middle cannot easily read or alter. It means the certificate was issued for that host. It does not mean the host is the company you wanted. Certificate authorities will issue a certificate for a domain the applicant controls. A fake site with its own domain can show a padlock. A browser warning about a broken certificate is a reason to leave. The absence of a warning is not a reason to trust the name.

Extended certificates and the old green-bar company names are not a check you should depend on. Browsers have spent years removing extra chrome that people misread as an identity badge. The identity you can actually verify by eye is the host string. If you want a second source for the host, use a page you reached earlier by typing, or the official site linked from a profile on this site, not the certificate popup on the page you are already doubting.

How the wrong host gets opened

Search ads sit above the results and can bid on the brand name. The headline can be the brand. The URL under it can be someone else. Organic results are not safe either. They are ranked links, not a registry of official sites. Type the host you mean. After it loads, and only after the host matches, bookmark that exact origin. The next visit starts from the bookmark. A bookmark can still be edited by malware on the computer. It is still a better habit than searching the brand every time you want to log in.

Messages are the other door. A direct message, an email, a ticket reply, and a text can all carry a link whose anchor text is the real brand and whose target is not. Press and hold, or hover, and read the host the device will actually open. On a phone, the long-press preview is the moment you have. If the host is wrong, do not open it 'just to check'. Some pages record the visit and start a connect prompt immediately. Close it.

QR codes are a link you cannot read until the camera has resolved them. A code on a sticker, a slide, or a printed insert in a package is a URL someone else chose. If you need a vendor's site, type the host from the profile or from the card the vendor published, and ignore the sticker. This matters for hardware wallets as much as for exchanges. A code in the box that asks you to 'verify the device' on a website is a phrase-stealing page until the host proves otherwise, and a genuine setup does not need you to type the recovery words into that website at all.

A worked reading of two hosts

Take a made-up brand, Northwind Wallet, whose real site you have decided is northwind.example. A message says 'support ticket' and the link preview shows northwind.example.secure-login.example. The rightmost name you are registered under is secure-login.example. northwind.example is a subdomain label that the owner of secure-login.example created. You are not on Northwind. Leave. Nothing later on the page changes that, including a live chat window that already knows your first name. Names leak. Hosts do not become real because the page greets you.

A second link shows northwind.example/claim, and you typed northwind.example yourself this morning and saved it. The host matches. The path is /claim, which you did not ask for. Matching host does not mean the page is a feature the company intended. It means you are talking to their server, or to whoever currently controls their DNS and their site. If Northwind has been defaced, the host is still theirs and the content is still hostile. Read what the page asks you to sign. Host match is the first check. It is not the last.

A third case is an extension popup. Browser extensions do not put the exchange's host in the address bar of the popup. The popup is software installed locally. Its name in the extension list can be copied. Install extensions from the vendor's own host, typed by you, following their current install link, and then lock the extension list. A search ad for 'metamask extension' is how a second extension with a similar name gets into the browser. This site's MetaMask and Phantom profiles link to the vendors. Use those when you are not sure which host is real, then bookmark the host you land on after you have read it.

The moment a wallet is asked to connect

Connecting a wallet tells the site your address and lets it ask for signatures. A connection by itself does not move funds. The signature that follows might. The host check has to happen before the connection, because after you connect, the page can wait and request an approval when you are moving quickly. Read the wallet prompt. If it asks for a token approval, a permit, or a message you did not plan to sign, reject it. The drainer page describes those prompts. This page stops at how you arrived there.

A hardware wallet moves the same prompt onto a device screen. It does not check the website's domain for you. You still read the host on the computer, and you still read the address and the amount on the device. People mix those two screens up. The computer screen is where the site identity lives. The device screen is where the transaction fields live, and only if the wallet software passed those fields through for the device to show. If the device screen is blank or shows a hash you were told to ignore, you do not have a confirmation.

The token checker on this site accepts a contract address. It does not accept a website, and it cannot tell you that the page where you copied the address is the project you think it is. Paste the address if you want the contract report. Reach the checker by typing the host or using your bookmark for this site, not by a link in the same post that offered the token. A report can still be Low on a contract that a phishing site is using as bait, because the bait can be a real token and the theft can be the signature beside it.

Downloads, bookmarks, and a poisoned computer

Wallet installers and hardware companion apps should come from the vendor host you checked. A download that starts from a different host, even if the file name looks right, is a different file. This site does not host those installers and will not ask you to sideload one. After install, the operating system's own update channel or the vendor's app should be the only update path. A pop-up on a random site that says your wallet is out of date is a second site wearing a warning costume.

Keep a short list of hosts you actually use: the exchange, the wallet, the block explorer. Write them down the first time you verify them, if you want a copy that a webpage cannot rewrite. A browser profile used only for those bookmarks reduces the chance that a random extension, installed for a coupon, is sitting next to your exchange session. It is not a guarantee. It is a smaller room.

If the computer might already be compromised, the address bar itself can be a lie painted by local malware, and so can a bookmark. That is a worse problem than phishing. The practical response is to stop signing anything on that machine, move to a device you trust, and treat passwords typed on the bad machine as burned. Change them from the clean device. A hardware wallet still helps for coins, because the keys are not on the computer, but only if you read the device and you have not typed the recovery phrase into the bad machine. If you typed the phrase, the device is no longer the boundary. Make a new wallet on a clean device and move what is left.

A short check before you continue

Read the host. Decide whether it is the exact name you meant, not a name that contains the brand. Ignore the padlock, the logo, and the page title while you do that. If you did not mean to open a link, close it and type the host instead. If a wallet prompt appears before you have finished reading the host, reject the prompt, then read.

Hover or long-press links in mail and chats. Do not install an extension from an ad. Do not type a recovery phrase, a password, or a two-factor code into a page you reached from a message. Do not scan a QR code from a sticker when you could type the vendor's host. If the page is a claim for tokens you did not buy, you can ignore it. The fake-airdrop page is the longer version of that refusal.

When the host is right and the request is still an unlimited approval for a token you do not recognise, the host check has done its job and the transaction check starts. Reject it. Paste the contract into the checker if you want a report. Do not connect this site to your wallet. It does not ask.

Questions

Does a bookmark make me safe? It removes the search ad and the mistyped letter on an ordinary day. It does not help if the vendor's own site was taken over, or if malware on the computer rewrites the bookmark. It is still the right default, because those two failures are rarer than a lookalike link in a message.

Can I trust the link in the vendor's own social account? Only if you treat the social account as a lead and you still read the host before you continue. Social accounts get renamed, reply-guy'd, and occasionally taken over. The host is the check. The blue check on a social network is that network's badge, not the domain registry.

What about a link from this website? Profiles and guides on Perchance point at vendor sites and at our own pages. You should still read the host after you click, the same way you would from anywhere else. Affiliate links, where they exist, are labelled. A guide does not need you to connect a wallet to read it.

Will the token checker catch a phishing site? No. It scores a contract address from public sources. A phishing site is a hostname problem. You can be on the wrong host and holding a perfectly ordinary token, or on the right host and about to sign a disastrous approval. Do both checks when both are in front of you.

Is a private window safer? It forgets cookies when it closes. The host is unchanged, and you can still sign. Read the host anyway.