How to tell if an airdrop is legitimate: a scoring framework

A legitimate airdrop is one that is actually run by the project it claims to come from, using a contract and rules that project has published. That is a narrow definition on purpose. It says nothing about whether the token will be valuable. Keep those two questions separate: first, is it real; second, is it worth your time. This page handles the first. The scam guide explains what happens when the answer is no.

The 10-point scorer

Each check carries a weight reflecting how hard it is for a scammer to fake and how bad it is if it fails. Weights are our editorial judgement, not an industry standard, and they sum to 100. Tick what you have verified yourself, not what the page claims. Nothing here is sent anywhere; the state stays in your browser.

How to read the score

Below 50

Do not sign anything. Either you have not finished checking or the evidence is poor.

50 to 79

Unclear. If you proceed, use a fresh wallet with small balances and no approvals.

80 and above

Probably real. Still read every signature prompt.

Verifying official channels

The principle is a chain of trust that starts from something you reached independently and ends at the claim page. Every link in that chain must point forward, never backward from the claim page to a claim of authority.

1. 1

   Start from a source you found yourself

   Search for the project name plus docs, or use a link you saved earlier. Do not start from the link that triggered your interest.

2. 2

   Find the official site and documentation

   Check that the documentation is hosted on the same domain family as the website, and that it describes the airdrop in neutral terms.

3. 3

   Follow the link outward to the claim

   The official announcement should link to the claim domain. If the claim domain only appears on a social post, ask why.

4. 4

   Check the repository

   A real project normally keeps public code. Look for contract source, commit history spanning months, and issue activity. A repository created last week with one commit is weak evidence.

5. 5

   Confirm the social accounts are linked both ways

   The website should link to the accounts, and the accounts should link back to the same website. Cloned accounts usually fail one direction.

Domain age with RDAP, explained

Many fake claim sites are registered days before use. Registration data can reveal that. WHOIS was the traditional lookup protocol. ICANN describes RDAP as its replacement, developed by the IETF community with standardised data access and query responses, and says that since 28 January 2025, generic top-level domain registries and registrars no longer must offer WHOIS except for .com, .name and .post, while they must still provide RDAP (ICANN). In practice you will see both terms used for the same kind of lookup.

What to look at in the result: the creation date, the registrar, and the name servers. A domain created long before the campaign with stable details is reassuring. One created a few days ago on a registrar popular with disposable domains is a warning. Two cautions from our experience-based judgement: privacy services hide owner names on legitimate sites too, so do not treat redaction as guilt, and an old domain can be hijacked or expired and re-registered, so age is a signal rather than proof. The ICANN Lookup tool is one place to run the query.

On-chain contract verification and audits

A claim contract is where the tokens actually come from. Open the address in a block explorer for the relevant chain and check four things.

• The address matches the documentation. Copy it from the official docs and compare the first and last six characters at least. Better, compare the whole string.
• Source code is verified. Explorers can display verified source that compiles to the deployed bytecode. Unverified contracts are not automatically malicious, but they deserve a lower score.
• The function you will call is a claim. Look for a function that checks a proof or eligibility and sends tokens to the caller. Be alarmed by code that pulls tokens from the caller.
• Deployment age and activity. A claim contract with no prior transactions right before launch is normal. A contract deployed minutes ago by a freshly funded address that is announced only in a DM is not.

Audits: look for a report hosted by the auditor itself, with scope, date and findings, and a link to the reviewed commit. A logo on a project page is not an audit. An audit also does not prove that the claim page in front of you is the audited deployment. Our editorial position: treat an audit as a bonus on the project side and never as a reason to relax on the signature screen.

Claim page walkthrough

You have decided the airdrop probably is real. Now the page itself.

1. Use a burner or low-balance wallet for the first test where the rules allow it. See the burner wallet guide. Note that eligibility is tied to the address that earned it, so a burner only makes sense for claiming to a wallet that was already used for the activity, or if the rules allow delegation.
2. Compare the URL to the one in the official docs, character by character.
3. Connect, but do not sign yet. A real eligibility checker shows whether your address qualifies before asking for anything.
4. Read the first prompt. A claim should be a transaction to the verified claim contract. Anything that approves a token spender, grants permit authority or calls setApprovalForAll is a stop sign. EIP-721 documents that an operator approved this way can transfer the covered NFTs, and EIP-2612 documents that a permit signature sets an allowance without a transaction from you.
5. Check the amount against the published formula. If the project published a formula or table, the number shown should fall inside it.
6. After claiming, check approvals. Follow the revoke guide to confirm nothing was granted.

Worked examples: documented distributions vs common fake patterns

Comparing a documented real distribution to the fakes you will actually meet shows which checks do the work. The two real cases below are drawn from the projects’ own documentation.

The arithmetic on the fake card is simple. Checks 4, 6, 7, 8 and 9 might pass by accident, for example a copied real contract address, but the fake loses the weights for 1, 2, 3, 5 and 10,, which total 55 of the 100 points. That is why those five carry the heaviest combined weight in the scorer.

The time limit in the Arbitrum case teaches a second lesson. Real claim windows are documented and end. A page that offers to claim an old distribution long after the documented window closed deserves extra suspicion, since the docs state ARB is no longer claimable.

What we would check first

Our own order, as editorial judgement: first the claim domain against the official docs, then the signature type, then the contract address. Those three take under two minutes and catch most of what we see. Domain age, repository history and audits come afterwards, because they are slower and each one is easier to imitate. A scammer can copy a logo, a thread or even a real contract address; it is much harder to get the official documentation to link to a fake claim domain.

Be consistent about one more habit. Write down the claim URL and contract address you verified. If the page later redirects to a different domain or asks for a different contract, treat it as a fresh, unverified claim and start the scoring again.

What legitimacy does not guarantee

• Value. A verified airdrop can be worth little, and prices can fall quickly once tokens are tradable. Nothing about the checks above measures that.
• Tax outcome. Receiving tokens may be taxable depending on where you live. Our tax guide explains how to think about it and where to read the rules.
• Exchange support or delisting. Whether you can sell on a given venue is decided by the venue. See where to sell airdrop tokens.
• Safety of your wallet afterwards. A real claim followed by a careless approval elsewhere still costs you.
• Eligibility for you. A project can be honest and you still get nothing. If a page promises that everyone qualifies, be careful.

Where to go from here

Use the scorer each time, not just for ones that feel suspicious; the dangerous campaign is the one that feels normal. If you already signed something you now doubt, go straight to the revoke guide, then report the site to Chainabuse. For a broader introduction, see what a crypto airdrop is.

Written and fact-checked by the airdrop.promo Editorial Team. Method: how we verify. Spotted an error? contacts@airdrop.promo. Educational content only, not financial or tax advice.