How to spot a fake Solana dApp link before you connect
Most Solana wallet drains start with a link — shared in Telegram, posted on Twitter, or sent by someone impersonating support. The page looks familiar. The connect button sits in the same place. By the time your wallet prompts you to approve, the trap is already set. This guide walks through the checks that take thirty seconds and prevent most connection mistakes.
Start with the URL, not the logo
Phishing sites copy logos, color schemes, and layout from legitimate dApps. What they struggle to copy is the official domain. Before clicking connect, read the full address bar:
- Subdomain tricks:
jupiter-exchange.comis not Jupiter.app-jupiter.agis not Jupiter. The real swap interface lives at documented official domains — bookmark them. - Homoglyphs: Attackers replace letters with visually similar Unicode characters. A Latin "a" and a Cyrillic "а" look identical but resolve to different domains.
- TLD swaps: Moving from
.comto.io,.xyz, or.agis a common pattern for clone sites.
Verify through a second channel
If you found a link in Discord or Telegram, open the project's official website separately — type the URL yourself or use a bookmark — and navigate to the dApp from there. Legitimate projects link to the same interface from their docs. If the link you received goes somewhere different, treat it as suspicious.
Read the WalletConnect or extension prompt
When you click connect, your wallet shows which site is requesting access. Check that the domain in the prompt matches what you expect. A prompt saying "Connect to unknown site" or a domain you do not recognize means stop. Close the tab. Do not approve "just to see what happens."
Watch for urgency language
Fake airdrop pages often claim a allocation expires in minutes or that you must connect immediately to claim. Real token distributions rarely work this way. Urgency is a social engineering tool, not a feature of legitimate Solana programs.
Check the transaction preview before signing
Even after connecting, you have one more gate. Before approving any transaction, read the simulation your wallet provides. A drain transaction typically shows your tokens or SOL leaving with nothing equivalent coming in. If the preview lists unlimited token approvals to an unknown program, reject it.
What to do if you already connected
Disconnect the site in your wallet's connected apps list. Revoke any approvals you may have granted. If you signed a transaction, see our guide on the first 48 hours after a suspected drain. Speed matters for limiting further loss.