Fake Swap Sites, Fake Support, Fake Airdrops: A Checklist
On 26 Oct 2026 we built 28 lookalike domains of this site and asked DNS which exist: 7 answered, 21 did not. Then we checked certificate dates, Certificate Transparency, nameservers and mail policy, and wrote down the 90-second routine that separates a real swap page from a clone.
The measurement. On 26 October 2026, between 06:01 and 06:05 UTC, we took this site's name and built 28 lookalikes: other TLDs, a hyphenated form, transposed letters, doubled letters, and the classic `veilswap.io.co` suffix trick. Then we asked DNS which ones exist. Seven answered — veilswap.com, veilswap.co, veilswap.app, veilswap.finance, veilswap.xyz, veilswap.cc and veilswap.trade. Twenty-one returned NXDOMAIN, including veilswap.org, veilswap.net, veil-swap.io and veilswep.io. Of the seven that resolve, four never completed a TLS handshake within eight seconds, one returned HTTP 404, one answered with a 302 to a domain broker, and one served a website-builder placeholder titled 'Veil Swap'. That morning, not one of them offered a swap form.
A padlock is not an identity. Domain-validated certificates are free and take minutes, so the lock icon only proves that whoever answered on port 443 held a certificate for the name you typed. This domain is 40 days old: WHOIS creation 2026-09-16T10:30:26Z, registrar GoDaddy, expiry 2027-09-16. Its live certificate came from Google Trust Services WE1, valid from 2026-09-16T10:02:48Z to 2026-12-15T11:00:26Z, covering veilswap.io and *.veilswap.io. Certificate Transparency holds five entries for the name across four authorities — Google Trust Services, Let's Encrypt on three separate issuances, and Cloudflare's TLS Issuing ECC CA 4. Four of the five cover veilswap.io, www.veilswap.io or the wildcard; the fifth covers a single subdomain that no longer resolves. That last entry is the useful part: CT records names nobody announced, and it is the only public, append-only list of who was issued a certificate for a name.
The ninety-second check. Four commands, no trust required. `whois veilswap.io` gives the creation date; ours is 40 days before writing. `openssl s_client -connect veilswap.io:443 -servername veilswap.io | openssl x509 -noout -issuer -dates -ext subjectAltName` gives issuer, validity and names; ours is Google Trust Services WE1, 2026-09-16 to 2026-12-15. A Certificate Transparency search gives the history; five entries in 40 days is what a new domain looks like, and one entry dated yesterday is what a clone looks like. `dig NS veilswap.io` gives the nameservers; ours are arch.ns.cloudflare.com and imani.ns.cloudflare.com, with mail at route1-3.mx.cloudflare.net. A clone can copy the headers, the layout and the wording in an afternoon. It cannot copy the dates, the CT history or the nameserver pair without controlling the name.
What the seven actually were. veilswap.com, registered 2026-05-17, now sits on NameBright nameservers and answers HTTP 302 to hugedomains.com — the name is for sale. veilswap.co and veilswap.trade sit on GoDaddy nameservers and never completed TLS. veilswap.app runs on Vercel with a Let's Encrypt certificate dated 2026-09-20 and returns 404. veilswap.finance is suspended by its registrar: its nameservers are literally verify-contact-details.namecheap.com and failed-whois-verification.namecheap.com. veilswap.cc, registered 2026-10-04, has a single nameserver that is a Railway host, and a certificate dated 2026-09-27 — seven days before its own registration record, because the certificate belongs to the host, not to the name. veilswap.xyz, registered 2026-05-23, serves a GoDaddy site-builder placeholder titled 'Veil Swap'. I am not calling any of these a scam; I cannot see intent, and a parked name is not a crime. The narrower point is enough: a name that resolves tells you nothing, and these seven told us nothing in seven different ways.
The letters that are not letters. veilswap.io is eleven characters. Replace the a with Cyrillic а (U+0430) and the string renders identically in most fonts; DNS sees xn--veilswp-7fg.io. Replace the i with Cyrillic і (U+0456): xn--velswap-sog.io. Put the Cyrillic і in the TLD: veilswap.xn--o-evb. Browsers show the punycode prefix only when a label mixes scripts, and the rest of the time they show you the lie. The subdomain version is cheaper still: support.veilswap.io.evil.example is a host inside evil.example, and on a phone the right-hand end of a URL is usually the part that gets truncated. The rule is one line: read the domain backwards from the first single slash, and treat any xn-- as a stop sign.
Nobody will message you first. This site has exactly one support channel: email to [email protected], the same address published in the terms and privacy pages. There is no Telegram support desk, no Discord, no agent who found your order id in a database and opened with it. Check the header rather than the display name: the SPF record is v=spf1 include:_spf.resend.co ~all, and DMARC is p=none with reports to [email protected]. That p=none is a real weakness and I will not dress it up — it asks receivers to monitor, not to reject, so a forged From: can still land in your inbox. There is also no CAA record on the domain today, which means any certificate authority may issue for it. Both are on the fix list. Until they change, the only reliable check is the domain of the link you are asked to click.
The airdrop wants the one thing no wallet must give. A seed phrase is the wallet, not a password: whoever holds the twelve or twenty-four words owns the balance, and no service needs them to send you a token. The same holds for the order form here, which asks for a destination address, an optional refund address, and nothing else — no email, no password, no seed. The deposit address is issued per order and appears on the order page after you create it, so an address arriving in a DM, a comment or a video description is not an address from this site, whatever logo sits next to it. Token approvals are the second half of the same attack: an unlimited allowance to an unknown contract can move a balance later with no further signature, which is why the approval screen deserves the same suspicion as the seed-phrase screen. (seed backup guide)
The checklist. (1) Type the domain; never click through. (2) Certificate dates must be weeks old, not hours: ours was issued 28 minutes before the registry record, which is what a launch looks like, while a clone often has hours. (3) Search the name in Certificate Transparency; one entry dated yesterday is one day of history. (4) Check the nameservers; a clone on shared hosting rarely matches. (5) No message ever carries a deposit address. (6) Before sending, compare the first six and last six characters of the address with the order page, and let the checksum catch the middle. If you already sent: the transaction is final in seconds, there is no chargeback, and the only real remedy left is that the destination was an exchange deposit address you can ask to freeze.
The honest limits. This is 28 variants of one name on one morning; homoglyph space is effectively infinite and registrars add names every day. Certificate Transparency proves a certificate exists, not who asked for it or why. Domain age cuts both ways — ours is 40 days old, so 'old domain' as a trust signal would fail us too, and I would rather write that down than pretend otherwise. What survives all of it is a habit in three parts: verify the transport (certificate dates, CT history, nameservers), verify the channel (email only, no first contact), verify the destination (order page, checksum, first and last six characters). The habit costs ninety seconds. Skipping it costs whatever you paste: at 06:03 UTC today, 100 USDT-TRC20 quoted 0.14928856 XMR — a quote-implied 669.84 USDT per XMR against a 588.09 spot price — and no part of that comes back. (XMR to USDT exit)