Phishing Attacks Targeting Crypto Users

Go: open a terminal in a folder you can write to, for instance cd ~/Desktop (Windows: cd %USERPROFILE%\Desktop).

Do: save this as lookalike.py and run python3 lookalike.py. Copy it exactly — the fourth character of the second name is a Cyrillic letter, and copying by hand will destroy the whole point.

real = "binance.com"
fake = "binаnce.com"          # the 'a' here is Cyrillic U+0430

print("they look the same :", real, fake)
print("they are the same  :", real == fake)
print()
for label, name in (("real", real), ("fake", fake)):
    print(label, "->", " ".join(f"U+{ord(c):04X}" for c in name[:8]))

You should see: two names your eyes cannot separate, and one position where the computer can:

they look the same : binance.com binаnce.com
they are the same  : False

real -> U+0062 U+0069 U+006E U+0061 U+006E U+0063 U+0065 U+002E
fake -> U+0062 U+0069 U+006E U+0430 U+006E U+0063 U+0065 U+002E

Position four: U+0061 is the Latin letter a, U+0430 is the Cyrillic letter а. They are drawn identically in almost every font on earth and are completely different characters, so they are completely different domains, owned by different people. No amount of careful looking will separate them.

If not: if the second line prints True, your editor “helpfully” normalised the Cyrillic character back to Latin when you pasted — use a plain editor such as Notepad, TextEdit in plain-text mode, or nano. If you see SyntaxError: invalid character, a smart-quote replaced a straight quote; retype the quotation marks.

Go: same folder.

Do: save this as punycode.py and run it. Domain names can only travel as ASCII, so anything else is converted first — and the conversion is visible.

fake = "binаnce.com"

print("what your eyes read     :", fake)
print("what the browser fetches:", fake.encode("idna").decode())

You should see: the disguise falling off:

what your eyes read     : binаnce.com
what the browser fetches: xn--binnce-5nf.com

That xn-- prefix marks a name containing non-ASCII characters. Most browsers show it in the address bar for exactly this reason, so a wallet or exchange address that suddenly reads xn-- is not a glitch — it is the warning. Some browsers only show it for certain scripts, which is why the next step exists.

If not: UnicodeError: label empty or too long means the string lost its Cyrillic character in copying, leaving something IDNA cannot encode. If it prints binance.com unchanged, the same thing happened — a pure-ASCII name converts to itself.

Go: same folder. Two lines is all the defence needs.

Do: save this as detect.py and run it.

def looks_safe(domain):
    bad = [c for c in domain if ord(c) > 127]
    return "SAFE (plain ASCII)" if not bad else \
           "SUSPICIOUS: " + ", ".join(f"{c!r} = U+{ord(c):04X}" for c in bad)

for d in ["binance.com", "binаnce.com", "ledger.com", "lеdger.com"]:
    print(f"{d:16s} {looks_safe(d)}")

You should see: the two impostors named, with the exact character that gives them away:

binance.com      SAFE (plain ASCII)
binаnce.com      SUSPICIOUS: 'а' = U+0430
ledger.com       SAFE (plain ASCII)
lеdger.com       SUSPICIOUS: 'е' = U+0435

Keep this file. When a link arrives by email, message or a search result, paste the domain into the list and run it. It takes three seconds and catches an attack class that careful reading cannot.

If not: if every line says SAFE, the Cyrillic characters were lost in copying — go back to step 1 and copy from the page again. Legitimate international domains do contain non-ASCII characters, so treat SUSPICIOUS as “stop and verify by another route”, not as proof of fraud.

Go: same folder. This step needs no Unicode trickery at all — these domains are honest ASCII, and still lie.

Do: save this as whereami.py and run it.

from urllib.parse import urlparse

urls = [
    "https://app.uniswap.org/swap",
    "https://app.uniswap.org@wallet-drainer.xyz/connect",
    "https://metamask.io.security-check.app/verify",
    "https://trezor.io/start",
]

for u in urls:
    host = urlparse(u).hostname
    print(f"{host:32s} <- {u}")

You should see: two of the four going somewhere other than where they appear to:

app.uniswap.org                  <- https://app.uniswap.org/swap
wallet-drainer.xyz               <- https://app.uniswap.org@wallet-drainer.xyz/connect
metamask.io.security-check.app   <- https://metamask.io.security-check.app/verify
trezor.io                        <- https://trezor.io/start

Two separate tricks. Everything before an @ in a web address is ignored as a username, so the second link goes to wallet-drainer.xyz while displaying a name you trust. And in the third, metamask.io is merely a subdomain of security-check.app — anyone can create it in thirty seconds. Ownership is decided by the last two labels before the first slash, read right to left. Everything to their left is chosen by whoever owns them.

If not: if the second line prints app.uniswap.org, the @ was dropped in copying. If hostname returns None, the URL is missing its https:// prefix.

Go: same folder. The last step of a crypto phishing attack is rarely “send us your coins” — it is a token approval that looks routine.

Do: save this as approval.py and run it.

MAX = 2**256 - 1
ONE_TOKEN = 10**18

print("amount the popup is asking you to approve:")
print("  raw   :", MAX)
print("  tokens:", f"{MAX // ONE_TOKEN:,}")
print()
print("what a 50-token swap actually needs:")
print("  raw   :", 50 * ONE_TOKEN)
print("  tokens: 50")

You should see: the two numbers side by side:

amount the popup is asking you to approve:
  raw   : 115792089237316195423570985008687907853269984665640564039457584007913129639935
  tokens: 115,792,089,237,316,195,423,570,985,008,687,907,853,269,984,665,640,564,039,457

what a 50-token swap actually needs:
  raw   : 50000000000000000000
  tokens: 50

That first number is the largest value the token standard can hold, and wallets often render it as “Unlimited” or simply as a wall of digits nobody reads. Approving it hands a contract permission to move that token out of your wallet at any point in the future, with no further prompt. Before approving anything, look for the amount and check it is roughly the size of the trade you are making. A swap for 50 tokens that requests an unlimited allowance is asking for something it does not need.

If not: ValueError: Invalid format specifier means the :, inside the f-string was mistyped. If the token line looks rounded or ends in zeros, you used / instead of // — ordinary division loses precision at this size, which is itself a good reason to distrust a displayed amount.