01
Analyze
We verify the report and preserve technical and on-chain evidence. Every escalation that follows is built on it.
Crypto & Web3
Take down the fake site impersonating your crypto project
In crypto, the theft is instant and irreversible. When a fake site, wallet drainer, or cloned exchange wears your project’s name, we find it and take it down on demand. You only pay when it’s offline.
- Pay only on success
- We handle every step
- European & GDPR-aligned
Trusted by
Crypto threats
What we take down
The fakes that wear your project’s name to earn the trust they need to steal. Each links to a short definition in our glossary.
Incident response
Your first hour after finding a fake
When funds can move in seconds, the first hour decides how much damage a fake does. Here is the order that limits it.
Or skip the legwork: send us the URL and we run all five for you.
- 01
Preserve evidence
Screenshot the fake site, save the exact URL, and capture the on-chain trace or contract address. Every report downstream depends on it.
Scan the page for free - 02
Warn your community
Pin a clear notice on your real channels (X, Discord, Telegram) so users stop interacting with the fake while it is still live.
- 03
Report to registrar, host & Safe Browsing
File abuse reports with the domain’s registrar and hosting provider, and submit the URL to Google and Microsoft Safe Browsing.
- 04
Push it to wallet blocklists
Get the malicious domain flagged across the major wallets so MetaMask, Phantom, and others warn users on connect.
- 05
Engage a takedown
Hand the case to a team that knows the escalation paths, so the site comes down and stays down while you focus on your users.
Where it gets removed
Every incident has a removal path
A fake is only gone when the right party acts. We hit the layer that actually takes it down, usually several at once.
-
Wallet drainer / fake claim site
Registrar suspension + Host removal + Wallet blocklists -
Fake airdrop or token site
Registrar + Host + Google & Microsoft Safe Browsing -
Cloned exchange or dApp
Host + Registrar + App-store report where an app exists -
Lookalike / typosquatting domain
Registrar abuse + DNS provider -
Fake Telegram / Discord support
Platform abuse report (e.g. Telegram @notoscam)
| Incident | Where it gets removed |
|---|---|
| Wallet drainer / fake claim site | Registrar suspension + Host removal + Wallet blocklists |
| Fake airdrop or token site | Registrar + Host + Google & Microsoft Safe Browsing |
| Cloned exchange or dApp | Host + Registrar + App-store report where an app exists |
| Lookalike / typosquatting domain | Registrar abuse + DNS provider |
| Fake Telegram / Discord support | Platform abuse report (e.g. Telegram @notoscam) |
Workflow
How we take it down
Four steps, from first review through to watching for the operator coming back.
-
- 02
Escalate
We contact the registrar, host, and platforms behind the fake with documented evidence. In parallel, we push it to wallet and browser blocklists.
- 03
Resolve
We drive the case through to removal and keep your team updated on every status change along the way.
- 04
Stabilize
After removal we watch for the same operator spinning up replacements, so a recurring campaign does not slip through.
Why nebty
Built for crypto teams, not enterprise procurement
To be clear about scope: we take down the impersonating infrastructure, meaning the fake sites, domains, and accounts. We do not recover stolen funds, and on-chain theft is almost always irreversible, which is why removing the source quickly is what limits the damage.
Pay only on success
No success, no fee. We charge for a removed threat, not for a subscription or a dashboard full of alerts.
No subscription, no retainer
Crypto attacks arrive in bursts around launches and airdrops. On-demand takedowns fit that rhythm, so you engage us when you need us.
European & GDPR-aligned
A product-led European provider in a field dominated by US vendors, with EU data residency and native German-language service.
Crypto impersonation is one front of brand impersonation protection. See the full takedown service, or get ahead of the next one with domain monitoring and social media monitoring. Not crypto-specific? See phishing takedowns and fintech impersonation takedowns.
Common questions
What crypto teams ask us
Short answers to the questions we hear most about this topic.
Your question is not on the list? Ask Benedikt directly How do I take down a fake website impersonating my crypto project?
Report it to us with the URL and we handle the rest. We preserve evidence, identify the registrar and host behind the domain, and file structured abuse notices, while flagging the domain to Google and Microsoft Safe Browsing and the major wallet blocklists so wallets and browsers can warn users during the takedown. You only pay if the site comes down.
How fast can a crypto phishing or wallet-drainer site be taken down?
It depends on the registrar, the host, and how clear the evidence is. Straightforward cases are often resolved within 24 to 72 hours; bulletproof hosts or operators abroad can take longer. Because blocklisting runs in parallel, wallets and browsers can start warning users well before the host removes the page.
How do I report a fake token or fake airdrop claim site?
Send us the contract address, the claim-site URL, and any social posts promoting it. We go after the claim site through the registrar, host, Safe Browsing, and wallet blocklists, and report the accounts pushing it. Note that on-chain theft is almost always irreversible, which is exactly why removing the site quickly matters.
How do I get a fake support account on Telegram or Discord removed?
We report it to the platform with the evidence it needs to act, using each platform’s abuse process (for example Telegram’s @notoscam). Fake admins and "support" accounts impersonating your team break platform rules, which is the lever we use to get them removed.
How much does a crypto scam-site takedown cost?
There is no subscription and no retainer. You only pay for a successful takedown, which suits the bursty, campaign-driven way crypto attacks arrive. See our pricing page for the details.
What can I do about a lookalike domain copying my exchange or wallet?
Lookalike and typosquatted domains can often be challenged at the registrar even before they host a live scam. Our domain monitoring surfaces new lookalikes early, and when one is weaponised we take it down, so you are not relying on a customer to report the next one.
Act now
A fake site is draining your community? We take it down.
Send us the case (a fake site, drainer, token, or support account) and we manage the removal end to end. You only pay when it’s offline.
Have questions? takedowns@nebty-id.com
Benedikt Scheungraber
Co-Founder & CEO
Questions about brand protection, or want to see nebty in action? I’m happy to walk you through it myself and talk openly about whether we can help with your case.