Most ENS scams come down to three attacks: a malicious transaction you approve in your wallet, a recovery phrase you type into a fake login, or funds you send to the wrong address. Nine rules block almost all of them.

Messages telling you to upgrade, migrate or sync your ENS name before a deadline. They arrive by email, and as direct messages on X, Discord and Telegram. The link leads to a page that asks you to connect your wallet and approve a transaction.

Upgrading is real, but it is optional and has no deadline. ENS may ask you to upgrade: the risk is the link in the message, not the ask. Upgrade only in the ENS App, at app.ens.domains opened yourself.

A warning that you are about to lose your name, with a link to renew it. It arrives by email, and as direct messages on X, Discord and Telegram. The link opens a page that asks you to connect your wallet and approve a transaction.

This one works because the deadline is real. Every name expires, and missing it does cost you the name, so the message carries a pressure a fake airdrop never does.

Check the date yourself instead. Search your name on app.ens.domains, read the expiry on the name's page, and renew from there. See Renew a name for the steps.

If the date has already passed, the grace period still lets you renew at the normal price for 28 days. Nobody else can register the name during it. There is no reason to rush through a link.

A page that looks like an NFT project. You connect your wallet, click "Mint", and approve a transaction. The transaction either transfers your NFTs straight to the attacker, or grants their contract a sweeping approval (often setApprovalForAll) that lets them move everything in your wallet later.

The fix is in the wallet pop-up. Before you approve, read what the transaction actually does. If it says "Set approval for all" on a contract you don't recognise, or transfers an NFT you weren't expecting to send, reject it.

A page that looks like MetaMask (or another wallet) asks for your recovery phrase to "unlock" or "verify". Never type your recovery phrase into a page that asks for it. ENS Labs never asks for it, and no ENS app or website needs it.

The same pattern crops up as fake browser pop-ups, "wallet update" prompts, and DMs from people claiming to be ENS support. If anything asks for your 12- or 24-word phrase, it's a phish.

Pages telling you to claim "your $ENS" by connecting your wallet. They harvest approvals, they don't send tokens.

Random tokens or NFTs appearing in your wallet. The swap or sell contract is malicious — interacting with it drains your other tokens. Don't click, don't swap, don't try to sell.

Scammers can plant fake addresses in your wallet's history. They send you a zero-value transaction from an address whose first and last few characters match one you've already used. Copy the fake address next time, and your funds go to the attacker.

Send to ENS names instead. A memorable, human-readable name like friend.eth points at one wallet, set by its owner. A lookalike address can't claim it.

Anyone can register an ENS name that copies any 0x address with .eth on the end. The name can point to any address; whoever owns it picks. Scammers register a name copying your address and point it at their wallet. Counting on you not knowing what ENS does, they tell you to append .eth to your address to "verify" by sending funds. The funds go to them.

Don't add .eth to your own address.

Move fast.