Sign inRegister

How to spot a fake airdrop website: the claim link is the attack

Every airdrop deadline sets off a race, and a fake airdrop website is how the second side wins it. Real recipients rush to claim, and fake claim pages rush to catch them first. Here's what the data says about both sides of that race, and how to confirm an official domain before you connect anything.

A red and yellow "DANGER" sign on a post at a rocky shoreline
Photo: ornaw / Pixabay

Why claim links matter: real value, hard deadlines

Airdrops move real money. CoinGecko's ranking of the 50 biggest airdrops puts their combined value at $26.6 billion, measured at each token's all-time-high price rather than what recipients actually took home (ranking as of 21 December 2023).

Some of that value runs on a clock. Two projects published hard claim deadlines for October 2026, and both have now passed:

Timeline marking the Sonic deadline on 15 October 2026 and the Pharos deadline on 25 October
Chart: the two October claim deadlines, as published by the projects. It says nothing about who is eligible. Sources: Sonic Labs (2 Apr 2026), Pharos FAQ (both re-verified 2 Oct 2026). Chart built by PoolIndex from the cited data.

This article doesn't say who qualifies for either program, and it can't. Only the projects' own portals and documents can. What's predictable is that deadlines bring urgency, and urgency is what fake claim pages sell. Once a deadline has passed, any page that still offers to "claim" is fake.

The problem: "Please be safe out there"

On 24 September 2023, the Arbitrum airdrop claim window closed at Ethereum block 18208000. The Arbitrum Foundation's official docs now say plainly: "$ARB is no longer claimable." When the leftover 69,448,385 ARB was moved to the DAO treasury, the foundation added a warning. According to The Block, reporting on 25 September 2023, the foundation posted: "You cannot claim those tokens anywhere. Please be safe out there."

A project that has just closed a claim window doesn't need to tell people to be careful unless something is waiting for them. The same docs have carried this line since launch: "The only official website for the $ARB airdrop is https://arbitrum.foundation. There is no presale." Starknet's FAQ is even more direct: "The Starknet Foundation is the sole body leading distributions of STRK. Anyone claiming to be leading parallel distributions is running a scam."

Projects write these sentences because the fake version of their claim page is predictable.

PULL QUOTE
"Anyone claiming to be leading parallel distributions is running a scam." (Starknet Foundation FAQ)

Close-up of a sharp fishing hook dressed as a bright lure
Photo: herriest / Pixabay

Finding 1: Airdrop phishing runs like a franchise

A 2025 academic study of "Drainer-as-a-Service" on Ethereum, summarized by BlockSec on 21 October 2025, describes an industry, not isolated scammers. Operators build and rent drainer kits, and affiliates spread them "through social media, fake airdrops, and compromised accounts." The researchers traced over $135 million stolen from 76,582 victims between March 2023 and April 2025, and identified and reported 32,819 phishing sites.

One finding stands out for anyone who relies on blocklists: "only 10.8% of the DaaS-related addresses in their dataset were previously flagged on public trackers like Etherscan."

Key-figure card: $135M stolen, 76,582 victims, 32,819 phishing sites, 10.8% of drainer addresses previously flagged
Chart: Drainer-as-a-Service key figures. Source: BlockSec on the ACM IMC 2025 paper, 21 Oct 2025. Chart built by PoolIndex from the cited data.

Finding 2: Losses fell, but the machinery didn't go away

Scam Sniffer's 2025 report (3 January 2026) recorded $83.85 million in wallet-drainer losses across 106,106 victims on EVM chains. That's down from $494 million in 2024. Scam Sniffer frames the drop carefully: the figure is a "lower bound," and "the decline in trackable losses may partly reflect a shift toward harder-to-track attack vectors." Its summary line is "Lower losses ≠ gone threats."

Bars showing $295M in 2023, $494M in 2024 and $83.85M in 2025 lost to wallet drainers
Chart: drainer losses and victims, 2023 to 2025. Source: Scam Sniffer, 3 Jan 2026. Chart built by PoolIndex from the cited data.

Scam Sniffer also found that losses track market activity. Monthly losses in 2025 ranged from $2.04M (December) to $12.17M (August), and the peak quarter coincided with the year's strongest ETH rally. Busy markets bring more claims, more links and more victims.

Line chart of monthly 2025 drainer losses peaking at $12.17M in August
Chart: monthly drainer losses, 2025. Source: Scam Sniffer, 3 Jan 2026. Chart built by PoolIndex from the cited data.

The wider picture is worse. Chainalysis estimates (13 January 2026) that $17 billion was stolen in crypto scams and fraud in 2025, with impersonation scams up 1400% year over year. A fake claim page is a form of impersonation.

Finding 3: "Base airdrop checker" links appear even where there's no token

Rumored tokens attract fake claim pages just as reliably as real ones. Base, Coinbase's Ethereum layer 2, said at BaseCamp 2025 that it is "beginning to explore a network token." In its official post of 15 September 2025, it added: "We're in the early phases of our exploration, and don't have any specifics to share around timing, design, or governance." As of that post, there was nothing to claim. Any "Base token checker" should be judged against the official Base channels, not a link in a reply. More in is there a Base token? and token rumors and checker bait.

How to spot a fake airdrop website: verify the domain from the project's side

1. Find the claim URL from the project, not from a search result

Start from the project's own blog, docs or verified account. Sonic's blog named its portal, and Arbitrum's docs named the one official website. Then type that address yourself. See how to find a project's official links.

2. Read the domain right to left: the fake claim website test

The part just before the top-level domain is the owner. claim.project.example belongs to project.example. A lookalike such as project-claim.example or claim.project.example.support-page.example belongs to someone else. Pharos's portal passes this test because claim.pharos.xyz sits under pharos.xyz. Watch for swapped letters and extra words. Practice: how to read a URL right to left.

Diagram showing claim.project.example as a real subdomain and two lookalike domains marked with red warnings
Diagram: built by PoolIndex in code. Uses reserved .example placeholder domains only.

3. Check the deadline against the official page

If the window has closed, as Arbitrum's did, there's nothing left to claim and any page that says otherwise is fake.

4. Know what "checking" needs and what it doesn't

Checking needs your public address, nothing more. You connect a wallet only to claim, and only on the official portal. A seed phrase or private key is never part of either step.

5. Read every signature request

Drainer kits work by getting a signature. If the request is an approval or permit you don't understand, don't sign. If you already signed something, read token approvals: what your wallet history reveals.

6. Don't trust urgency, DMs or "support"

Replies under a project's post, DMs offering help and sponsored results are common routes for fake links. See research a claim URL before you click.

QUICK TEST: IS THIS AIRDROP LEGIT?
Did I get this link from the project's own channel? Does the domain belong to the project when read right to left? Is the window still open on the official page? Is this page asking for a signature just to "check"?

Where PoolIndex fits

Disclosure: PoolIndex publishes this guide.

PoolIndex is a research tool for Windows and Android for public crypto claims. Each result shows the network and how it was checked, and airdrop results link to their official source. Sources that fail are listed as failed rather than hidden. You can also research a claim URL before you open it: PoolIndex shows what was found on that link, with the evidence and the source for each finding, so you can weigh it yourself. It doesn't give a safe-or-unsafe verdict, and the project's own channels remain the only source for eligibility and the official claim domain. To research an address rather than a link, see how to check a wallet address without connecting it.

PoolIndex checks using your public wallet address only, the same address anyone can already see on the blockchain. It never asks for your seed phrase or private key, so it has nothing that could move your funds.

See how PoolIndex works. Get it from the Microsoft Store (Windows) or on Google Play (Android). Free after you register: check 1 wallet and 5 links a month. Windows and Android.

FAQ

How do I spot a fake airdrop website?
Get the link from the project's own blog, docs or verified account, read the domain right to left to confirm the project owns it, check the deadline on the official page, and refuse any request to sign or enter a seed phrase just to "check."

How do I know if a crypto airdrop is legit?
Only the project's own channels can confirm an airdrop and its claim portal. If the link came from a DM, reply or ad, or the page asks for a seed phrase or for you to send funds first, treat it as fake.

Is a claim site that asks me to connect my wallet a scam?
Not necessarily. Official portals, such as Pharos's, ask you to connect a wallet to claim. The warning sign is being asked to connect or sign just to check, or finding the link anywhere other than the project's own channels.

The deadline passed. Can someone still help me claim?
No. Arbitrum's foundation put it simply: "You cannot claim those tokens anywhere."

Is there an official Base airdrop checker?
Base's official post says it is only exploring a network token and has no specifics on timing, design or governance. Treat any "Base airdrop checker" or Base token claim page with suspicion.

Can any tool tell me a claim site is safe?
No tool can guarantee that. Research summarized by BlockSec found only 10.8% of drainer-related addresses had been flagged on public trackers beforehand. Treat any tool's output as evidence to weigh, and confirm the domain from the project's own channels.

What should I do if I signed something on a fake airdrop website?
Stop interacting with the site and review your token approvals from a tool you reach by typing its address yourself; revoke anything you didn't intend. If you entered a seed phrase, treat that wallet as compromised.

Sources