What the checker looks at
- The registered domain, not the whole host: in ledger.secure-wallet.top the site belongs to whoever owns secure-wallet.top.
- Look-alikes of official domains โ one or two changed letters, swapped letters, digits for letters (0 for o, 1 for l), rn for m, vv for w.
- Punycode (xn--โฆ) and mixed alphabets: a domain written partly in Cyrillic or Greek can look identical to a Latin one.
- Tricks in the URL itself: user@host links, bare IP addresses, non-standard ports, plain http.
- Shorteners that hide the destination, domain zones frequent in phishing reports, and bait words like claim, airdrop, restore, sync or verify.
Why heuristics are not a guarantee
A result of 'no warning signs' means only that the link does not match the patterns. A brand-new phishing domain with an unrelated name, a compromised legitimate site, a malicious browser extension or a fake app will pass. The reverse is also true: a legitimate site on an unusual domain can trigger a warning. Use the result as a reason to slow down, then reach the site the safe way.
The safe way is boring: type the address yourself or use a bookmark you created, install wallets from the developer's official site, and treat any page that asks for a seed phrase as hostile. No wallet, exchange, support agent or airdrop needs your recovery words.
Where phishing links come from
Search ads that outrank the real site for 'metamask download' or a DEX name; replies from fake support accounts under your post; Telegram and Discord direct messages about airdrops, refunds or account problems; QR codes on posters and in videos; e-mails copying exchange security alerts. The domain is the one thing a phisher cannot fully fake, which is why checking it โ letter by letter โ stops most attempts.
Frequently asked questions
+What is a homograph domain?
A domain that uses characters from another alphabet that look like Latin letters, for example Cyrillic ะฐ instead of a. Browsers show it as punycode (xn--โฆ) in some cases and as the look-alike text in others.
+The checker says the domain is official. Is the page safe?
It means the registered domain matches our list. Still prefer bookmarks, check the full address bar and never enter a seed phrase on any website.
+Why is a .xyz or .top domain flagged?
These zones appear often in phishing reports because names are cheap. It is a caution flag, not a verdict โ many legitimate projects use them too.
+Does the tool visit the website?
No. It analyses the text of the link in your browser. Nothing is fetched and nothing is sent to KOT.CASH.
+Is kot.cash on the list?
Yes. The official site is kot.cash; links to swaps elsewhere using our name are not ours.
Calculations run entirely in your browser; nothing you type is sent to KOT.CASH. Results are estimates for information only and are not financial, tax or legal advice.