Five Telltale Flaws of Fake Claim Pages

Fake claim sites are the standard form of airdrop phishing: a ‘claim’ page impersonating a project’s official site, built to lure you into connecting your wallet and signing malicious transactions. Scam Sniffer’s annual report lists them as the core customer-acquisition component of the drainer industry — of the roughly $494 million lost to phishing signatures in 2024, most incidents started with a fake page.

How the Industry Chain Works

Scam Sniffer’s research breaks this industry chain down in fine detail: tool families (Angel, Pink, Inferno, and others) offer ‘phishing as a service,’ and in the first half of 2024 the three of them held roughly 42%, 28%, and 22% of the market respectively; traffic acquisition has dedicated operators — buying ads, riding trending topics, taking over expired Discord links; and cash-out is automated sweeping. For users, this means the attack does not hit at random: the fake page you see was precisely delivered to you. The dedicated MS Drainer study shows that the advertising channel alone brought in 63,210 victims in about 9 months.

Three Technical Traits (per the verified report figures)

Hosting and disguise: phishing sites are mostly deployed on Cloudflare/Vercel/IPFS, with a Cloudflare shield or a fake CAPTCHA page added to block scanners. Signature disguise: victims are induced to sign offline signatures such as Permit or setOwner — the EIP-712 numerical-address bypass research shows attackers can even make the signing interface display a string of unreadable digits to get past security plugins. Ad cloaking: ads are targeted by region, so reviewers and ordinary visitors see a normal page while only targeted users see the phishing page.

Defense Checklist (editorial recommendations)

1. Verify the domain character by character — enter through bookmarks, not search ads;
2. Read the full content before signing: spender, amount, function name (see our token approval phishing case);
3. Interact with a quarantined wallet (see our wallet separation guide);
4. Already signed: act immediately with revoke.cash (see our guide to revoking approvals).

Reconstructing Two Disclosed Cases

The ad-channel case: the MS Drainer research documents fake Radiant pages run in Google search ads starting April 2023 (associated losses of about $4 million), followed by a shift to X feeds — the ‘Ordinals Bubbles’ series of phishing ads, of which 6 of a sampled 9 came from the same source. The alert-bypass case: the EIP-712 numerical-address attack jointly disclosed by Scam Sniffer and SlowMist — the contract address in the signature is passed in as a decimal number, the wallet normalizes it into the real address when encoding (so the signature is valid), but the UI shows a string of unreadable digits and the security plugin’s alert fails; it was linked to Pink Drainer (which the research report says ‘stole tens of millions of dollars over the past year’). Taken together, the two cases show: every link in the chain, from traffic acquisition to signing, has dedicated engineering behind it.

If the Page Looks Too Real to Be Fake

Three technical facts make ‘looking real’ worthless: the appearance can be cloned pixel by pixel (the toolkits are productized); a wallet’s transaction-simulation result can be fooled (one of the techniques disclosed in Scam Sniffer’s research); and a phishing site hosted on Cloudflare/Vercel shares the same CDN experience as the real one. That leaves only two anchors that do not depend on appearance: the domain itself (character by character, not ‘similar’) and the signature content itself (read the spender/amount/function). This principle is repeated in the conclusions of Scam Sniffer’s reports: users must stay suspicious of any signing request.

Common Mistakes

• Trusting the ‘page experience’ instead of the domain: fast loading, a padlock icon, or a customer-service popup do not constitute trust;
• Guarding only the first connection: approval is ongoing — clean at connect time does not mean clean at signing time;
• Treating security plugins as a get-out-of-jail-free card: the numerical-address research tested multiple wallets and plugins in practice and found blind spots in all of their alerts.

Practical Details of Domain Verification

‘Character-by-character verification’ is easy to say and has three practical points: use bookmarks, not the keyboard — once you have confirmed the domain from an official announcement, save it as a bookmark and only ever enter through that bookmark; watch for lookalike characters — 0/O, 1/l/I, rn/m, hyphens versus underscores: the substituted characters in phishing domains hide in exactly these positions; archive official announcements for comparison — screenshot the domain from the official X pinned post or announcement, and when a ‘new entry point’ appears, compare it against your archive. The domain is the one thing a fake claim page cannot clone perfectly — spend your verification effort where it counts.

Risk Notice

This article is not investment advice. Fake claim page tactics are updated with each reporting cycle; defer to the latest versions from security sources such as Scam Sniffer.