How do I confirm a swap deposit address is real and not a cloned site

05 September 2026

You confirm a swap deposit address is real by verifying it directly from the official domain, not from a link, email, pop-up, or search result. The only trustworthy source is the site you navigated to yourself, by typing its URL into your browser.

Cloned sites are fake copies of real exchange services. They look identical to the original. Their goal is to show you a deposit address that belongs to an attacker. You send funds there and they vanish. The clone is often promoted through ads, phishing emails, social media messages, or search results that rank slightly below the real site.

How to check before you send

1. Type the URL manually. Never click a link from a chat, email, or ad. Bookmarks you created yourself are also safe, but verify they still point to the correct domain. A clone can have a one-character difference: a "0" instead of "O", an extra hyphen, a different top-level domain.

2. Check the browser address bar carefully. Look for the exact domain. For whateverape.xyz, it must be exactly that. No variations. No extra subdomains like "swap.whateverape.xyz" if the real service does not use one. If you are unsure, open a new tab and type the domain from memory.

3. Confirm the site uses HTTPS. The padlock icon should be present and valid. But note: cloned sites often install their own SSL certificates. The padlock is not a guarantee. It only means the connection is encrypted, not that the site is legitimate.

4. Verify the deposit address against a second source. If the exchange provides a public API or a status page that lists deposit addresses, cross-reference. Some services let you regenerate the same address multiple times. If the address changes unexpectedly, that is a red flag.

5. Send a very small test transaction first. This is the most reliable practical check. Send a minimal amount to the address shown. Wait for confirmations. If the deposit arrives in your account on the real site, the address was correct. If it does not appear, do not send more. Investigate before proceeding.

6. Check for obvious signs of cloning. Cloned sites often have broken links, missing pages, unusual contact information, or no HTTPS redirect. They may also display a different favicon or slightly different fonts. But skilled clones can be nearly perfect. Do not rely on visual inspection alone.

What to do if something goes wrong

If you sent funds to a suspected cloned address, stop immediately. Do not send more. Do not attempt to "recover" by sending again. Contact the real exchange’s support through its official channels - again, accessed by typing the URL. Provide the transaction hash and the address you sent to. Most legitimate exchanges cannot reverse a blockchain transaction, but they may be able to flag the receiving address or assist with law enforcement if the amount is large.

If you have not yet sent funds but suspect you are on a clone, close the tab. Clear your browser cache and cookies. Then navigate to the real site manually and change any passwords you may have entered on the fake one.

Why this matters for swapping safely

The broader topic of swapping crypto safely includes many checks: verifying addresses, understanding slippage, and knowing what to do when a swap fails or funds go missing. This page covers one specific check - confirming the deposit address is real. For the full picture, read the hub page "Swapping crypto safely." It connects each check into a complete workflow.

A cloned site is one of the most common ways people lose funds. The attack works because it exploits trust in familiarity. You have used the site before. You think you know what it looks like. That is exactly what the attacker counts on. The only reliable defense is a consistent habit: never trust a link, always verify the domain, and always test with a tiny amount before sending anything significant.

Back to nft markets