Every airdrop scam has the same shape: a website that looks plausible, a claim button, and a signing prompt that does something worse than it appears. And every one of them leaves evidence on-chain before you connect a wallet — the contract’s age, its deployer’s history, its holder distribution, its permissions. The blockchain is the scam checker; the websites just read it.

This is the exact verification workflow, five steps, about five minutes per airdrop, every tool free. It’s how you stop guessing whether a claim site is real.

Step 1: Verify the domain before anything else

The majority of airdrop drainers are delivered through lookalike domains — extra letters, hyphens, swapped TLDs, or a different top-level domain than the project uses. You can defeat all of it in one move: navigate from the project’s official channels only.

Find the project’s X account, GitHub org, or docs site from a source you already trust, and get the claim URL from there. Compare character by character. Bookmark it. A domain that arrived via DM, reply, or search ad is presumed fake until it matches the official one exactly.

This step alone filters out most attacks, because the scam economics depend on you arriving through their delivery channel, not the project’s.

Step 2: Find the claim contract and check its age

The claim page (or the project docs) references a contract address. Copy the address — from the official site, not from your wallet prompt — and open it on the chain’s block explorer: Etherscan for Ethereum and EVM L2s, Solscan for Solana, and equivalents elsewhere.

First look: when was it deployed? A contract created minutes or days before an “established” airdrop campaign is a hard stop. Legitimate projects publish their claim contracts after audits and announcements, and the deployment transaction typically predates the campaign by weeks.

Second look: is the source code verified? Unverified source on a claim contract is a flag — not a verdict (some legitimate teams verify late) but enough to slow down.

Step 3: Investigate the deployer

Click through to the account that deployed the contract. What you’re establishing is whether this is a project engineering account or a disposable attacker wallet.

Signals of a project deployer: account created long before the campaign, history of deploying the project’s earlier contracts, connections to the project’s other addresses (multisigs, treasury). Signals of a drainer deployer: account created days before deployment, no history except a sequence of similar contracts, and especially a pattern of deploying contracts that other users then interact with and lose funds to — the explorer’s token-transfer view shows the aftermath.

Step 4: Read the holder distribution

For the token being airdropped, open the holders tab. Distribution tells you what marketing copy cannot.

A legitimate airdrop spreads: many holders with small balances, plus the project’s known treasury and team wallets in known proportions. A disguised drainer or honeypot concentrates: a handful of wallets holding most supply, all created around the same block range, none labeled. If 90% of supply sits in five fresh wallets, the “airdrop” exists to bait buys, not to distribute.

Step 5: Decode what you’re signing

Only after steps 1-4 pass do you connect a wallet — and the final check happens at the signing prompt. Read it as data:

  • Plain claim transaction to the verified contract: the normal shape.
  • Token approval (approve / setApprovalForAll, especially for max amounts): this is a drainer signature. Real claims do not need your approvals.
  • Permit or Permit2 signature framed as “verification”: same threat, better disguise. Permit2 exploits work exactly this way — one signature that authorizes spending without any visible transaction.
  • Any seed phrase or “sync” prompt: the site is a harvester. Leave.

If you’ve already signed something on older wallets, run a revocation tool (revoke.cash or Etherscan’s token approval tool) and clear approvals you don’t recognize — approvals persist until revoked.

Compressing the workflow

Doing this manually each time builds judgment fast, but for volume there are automated layers: Token Sniffer and GoPlus score token contracts on these exact signals (age, holders, permissions, honeypot tests), and wallet extensions increasingly warn on malicious signatures. Use them as accelerators, not verdicts — the manual checks take five minutes and no automated tool catches network bait-and-switch, which only your eyes on the signing prompt catch.

The deeper versions of these techniques live in our wallet drainer guide and signature scam breakdown. For the scam taxonomy around claims specifically, see crypto airdrop scams explained — the case studies there (Wormhole lookalikes, Inferno Drainer) all failed exactly the checks in this workflow.

Five minutes of on-chain verification beats a support ticket to a bridge six months later. The checks don’t require trusting anyone — that’s the point.

Frequently Asked Questions

How do I check if an airdrop is a scam?

Run five on-chain checks: confirm the domain against the project's official X/GitHub/docs; open the claim contract on a block explorer and check deployer account age and verification status; review holder distribution for concentration in fresh wallets; check whether the contract contains unlimited approval or permit2 functions; and never proceed if the claim flow demands token approvals rather than a plain claim transaction.

What free tools work as an airdrop scam checker?

Block explorers (Etherscan, Solscan) cover contract age, deployer, holders, and verified source. Token Sniffer and GoPlus provide automated token risk scores. revoke.cash shows and revokes existing approvals. All are free — you do not need a paid subscription to verify an airdrop.

Can you check an airdrop without connecting your wallet?

Yes, and you should. Every check in the standard workflow — contract lookup, deployer history, holder distribution, domain verification — happens in a block explorer and browser, wallet untouched. Connect only after the checks pass. A site that demands a wallet connection before showing anything is already violating the safe pattern.

What does a drainer contract look like on a block explorer?

Common signatures: deployed minutes to days before the campaign, unverified source code, a deployer account with no history except deploying similar contracts, near-zero balance but high recent transaction count, and token approval functions (approve, setApprovalForAll, permit) in the ABI. Any one is a flag; several together are a verdict.

Is a verified contract safe?

Verification only means the source code is published — not that the code is benign. Drainers sometimes publish their malicious source deliberately because a green checkmark lowers your guard. Read what the code does (especially approvals) or rely on automated risk scoring plus the other checks in this workflow.