Fake sites, extensions, and impersonation

The short answer

Fake infrastructure works because it doesn't need to be perfect—it needs to be close enough to pass a distracted glance, and to show up where you happen to be looking: a search result, an app store listing, a link shared as "the official download." Verifying the source before you connect or install is the entire defense.

Where impersonation shows up

• Fake browser extensions. Listings that copy a real wallet's name, icon, and description, sometimes ranking near the legitimate extension in an app store search. Once installed, they can intercept what you type or prompt you to "import" a seed phrase directly.
• Cloned dApp frontends. Full visual copies of Jupiter, Raydium, or a launchpad, hosted on a lookalike domain, that request the same kind of approval a real swap would—except routed to a malicious contract.
• Fake mobile apps. Listings in official app stores that mimic a known wallet's branding closely enough to fool a quick search.
• Impersonated support tools. "Wallet checker," "airdrop eligibility," or "revoke approvals" sites that are themselves the phishing vector—see revoking approvals for how to evaluate a revoker tool before trusting it.

How to verify before you trust

1. Get download or connection links from the project's official docs or verified social account, not a search result or a shared link.
2. Bookmark the verified URL once and reuse the bookmark going forward.
3. Check an extension's publisher, install count, and review history—a wallet with a handful of installs and no history is a red flag regardless of how convincing the listing looks.
4. Confirm the domain in your browser bar matches exactly, including subdomain and TLD, every time—not just the first time.

Primary and official sources