Official addresses
| App | Official address |
|---|---|
| fomo | fomo.family, the App Store app "fomo" and Google Play (family.fomo.app) |
| pump.fun | pump.fun |
| GMGN | gmgn.ai |
| Axiom | axiom.trade |
| Photon | photon-sol.tinyastro.io (Photon runs on tinyastro.io; docs on pies-organization.gitbook.io) |
| Trojan | trojan.com (docs at docs.trojan.com) |
| BONKbot | t.me/bonkbot_bot, as linked from docs.bonkbot.io |
| Padre (Terminal) | trade.padre.gg |
Checked 2026-10-15. Type these yourself or bookmark them; do not trust search ads or links in DMs.
Fake domains named in security reports
| Imitates | Reported fake domains (do not visit) | What it does | Report |
|---|---|---|---|
| Photon | speedtrade[.]icu | Fake Photon site that triggers a drainer once a wallet is connected | PCrisk, Dec 2025 |
| pump.fun | pump-sale[.]live, pump-cashbacks[.]fun, helped-pump[.]fun, returnpump[.]fun, payment-pump[.]fun, pumpfunairdrops[.]fun, pumponeth[.]com | Fake "PUMP sale" and cashback pages that connect a drainer | PCrisk, Mar 2026 |
| Axiom | web-axiom[.]trade | Lookalike domain listed by PhishDestroy and the ScamSniffer blocklist | PhishDestroy record, first seen Feb 2026 |
Only domains named in the linked reports are listed, written with [.] so they are not clickable. This is not a complete list: new fakes appear daily, so the safe rule is to trust only the official addresses above.
How wallet drainers work
A drainer is a script on a fake site. When you connect your wallet, it asks you to sign something that looks routine, such as a login, a claim or a swap. The signature actually authorises transfers of your tokens or, on EVM chains, unlimited spending approvals. Once signed, the scammer can move your funds in seconds, and blockchain transfers cannot be reversed. Some versions ask for your seed phrase or private key directly (for example to fix a wallet or verify an airdrop) and simply import your wallet.
How people end up on fakes
Search ads that sit above the real result; replies and DMs from accounts posing as support; fake airdrop, cashback or token-sale announcements; lookalike domains with an extra word such as login-, web- or app-; and browser extensions or copied snippets that promise extra features for a trading terminal.
Rules that stop almost all of it
Bookmark the official addresses and only use the bookmarks. Never type a seed phrase or private key into a website or send it to anyone. Read what you are signing; if a site asks you to sign right after connecting with no trade, close it. Ignore anyone who DMs you first. Keep only trading money in your hot wallet.
If you think you were drained
Stop using the wallet. From a clean device, create a new wallet and move what is left. On EVM chains, revoke token approvals (for example with revoke.cash). Change the password and 2FA of the email or account you log in with. Report the site to the platform it imitates and to your local fraud authority. Be wary of recovery services: people promising to get funds back are very often a second scam.
Related
Wallets
Frequently asked questions
What is the official Photon website?
Photon runs on tinyastro.io; our link goes to photon-sol.tinyastro.io. Treat other domains claiming to be Photon as hostile.
Can a website steal my crypto just by visiting it?
Usually not by visiting alone. The theft happens when you connect a wallet and sign a request, or type in your seed phrase or private key.