uniswaap.org and friends: how lookalike domains fool careful people

Most crypto phishing does not start with a clever hack. It starts with an address that looks almost right. You click a link, the page is a pixel-perfect copy of Uniswap or Aave, you connect your wallet — and the rest is gone. The only thing that was fake was the address, and it was fake by a single letter.

The tricks scammers use

• Keyboard slips: unoswap, opnsea — one key next to the right one. Fat-fingered by you, or pre-registered by them.
• Look-alike letters: a Cyrillic "а" or Greek "ο" is indistinguishable from the Latin one in your address bar. So is "rn" standing in for "m".
• Fake endings: uniswap.co, aave.io, lido-fi.com — the name is real, the ending is not.
• Extra words: uniswap-v4.app, claim-aave.org, appuniswap.xyz — official-sounding decorations around a stolen name.
• Hidden names: uniswap.org.evil.com — the real name is in there, but the site belongs to whoever owns evil.com.
• Swapped numbers: 9inch instead of 1inch. Short names are the hardest to protect, because a one-letter change is often a real word.

Why your eyes can't be the only defense

These fakes are designed to survive a glance. The address bar is small, the font is ambiguous, and you are usually in a hurry — an airdrop is ending, a trade is moving. Scammers also buy ads, so the fake can sit above the real site in search results. Checking carefully helps, but it is a losing strategy as the only line of defense.

How CapyGuard catches them

CapyGuard checks every address before the page loads, against several thousand real crypto projects. It normalizes look-alike letters (Cyrillic, Greek, accents, "rn"→"m"), generates the common typos of each real name — omissions, doubled letters, swapped neighbours, adjacent-key slips — and understands fake endings, extra words, missing dots and swapped numbers. Each site gets a risk score from 0 to 100; dangerous ones never open at all, and you get a calm capybara warning instead.

Just as important, it tries hard not to cry wolf: real sites like uniswapv3.info and lido.app are on a verified list, and ordinary sites that merely resemble a short brand name get a gentle "be careful" rather than a block.

Habits that still matter

Bookmark the sites you use and navigate from your bookmarks. Be suspicious of links in DMs, replies and ads — especially anything with a countdown. And if CapyGuard warns you, read the reason before deciding to continue: it tells you exactly which trick the address is pulling.