Someone drops a Tari XTM airdrop into a feed. The page looks like a claim portal. Connect the wallet, it says, to check eligibility. Claim the tokens instantly. The host is close enough to the real one that a tired thumb will forgive it.
That is the whole trick. A fake clone of a real project’s airdrop. A Connect Wallet button dressed as a lookup. A drain waiting in the wallet you attach. Next week’s copy will use a different hostname. The costume stays the same.
Overview
The pitch is a Tari XTM giveaway. The page is a clone of a real claim portal. The button asks you to connect a wallet so it can check eligibility and hand over tokens on the spot. What the page actually starts is a crypto drainer that empties the connected wallet.
Tari is a real project. XTM is its token. The official claim portal lives on the official Tari airdrop portal. This article is not a review of Tari, and it is not a tour of one disposable host. It is about the clone pattern: lookalike domains that impersonate that portal, push Connect Wallet, and drain.
One clone in this wave sat at airdrop.tariprotocol.com. That host is already the wrong lesson to memorize. Scammers rotate domains. The next lookalike will add a different extra word, drop a hyphen, or steal a prefix that still contains tari and airdrop. If you learned only that one name, you will miss the next door.
The clone wants one hurried glance. You see Tari. You see XTM. You see airdrop. You do not read the rest of the host. Everything after that glance is theater. The real defense is boring. Type the official address yourself, or use a bookmark you saved before the rumor arrived.
The lookalike host is the tell
Read the two kinds of address the way a tired person reads them at 11:40 at night. The real one is airdrop.tari.com. The fake one is almost that, plus a serious-sounding extra chunk. Same first word. Same airdrop prefix. One extra syllable that makes the liar look more official, not less.
People who have been around crypto for five minutes have seen words like protocol, network, app, claim, and official on real sites. Those words sound technical. They sound like a project name. They sound like something a legitimate team would register. That is why they work. You are not being asked to visit a random string of letters. You are being asked to visit a host that is almost the real one, plus a word that feels like homework.
The official portal is not hiding. Tari publishes it at airdrop.tari.com. The official project site is the official Tari website. A real project that runs a real airdrop has to tell people how to recognize the legitimate portal, because clones exist. That warning is not a smear of Tari. It is the reason this costume pays.
A lock icon does not settle it. HTTPS only means the trip to that host is wrapped. It does not mean the host is Tari. Encryption can carry a wallet prompt to a criminal as neatly as it carries a login to a bank. If the registered host is not airdrop.tari.com, you are not on the official portal. You are on someone else’s lobby.
Phone browsers make the impersonation easier. The address bar is short. The host gets cut. You see airdrop.tari and stop reading. The extra word hides to the right, or wraps, or sits in a redirect you never inspect. If you did not type airdrop.tari.com yourself, assume you are not there until the full host is in front of you.
Type the official address, or use a bookmark you saved before this link arrived. Do not trust a card in a feed, a comment under a video, or a “claim is live” message that already contains the destination. The clone’s job is to be the first door you open. The official portal does not need that shortcut.
Check eligibility is the hook
The clone does not ask you to wire money. It does not ask for a seed phrase on the first screen. It asks you to connect a wallet to check if you are eligible, then to claim tokens instantly. That sentence is doing two jobs at once. Check eligibility sounds like a lookup. Claim instantly sounds like a tap, not a transfer.
Eligibility is a gift of a word. Real airdrops sometimes do have eligibility rules. Snapshots. Quests. Mining. Deadlines. The official Tari program publishes terms on its own portal. The clone borrows the idea and strips out the paperwork. There is no public allocation record on the fake page. There is no official announcement sitting on tari.com that points you to a stranger’s host. There is a button.
Instantly is the other half. Instantly means you should not open a new tab. Instantly means you should not compare the host. Instantly means the reward is already yours if you just finish the connection. People will wait on a suspicious investment pitch. People will not wait on a claim that is supposedly expiring while they stare at it.
Connecting a wallet is a habit now. You have done it on real apps. The prompt looks familiar. The page talks like a claim portal. The brain files the click under maintenance, not under payment. You are not sending XTM. You are checking a list. That is the story the button tells. The story is false.
A connection is not a gift. A connection is a conversation with software you do not control. The clone needs that conversation. Until the wallet is attached, the page is only a picture. After the wallet is attached, the page can ask for a signature, an approval, or a transaction that moves value. The eligibility check is the costume. The permission is the product.
The drain is the product
Once the wallet is connected, the clone activates a cryptocurrency drainer. The tool is built to empty the connected wallet by sending holdings to addresses the operator controls. Tokens, coins, and whatever else the wallet will sign for can leave in the same session, or a short time later, after an approval has been granted.
You may not see a big red “send everything” label. Drainers hide inside ordinary-looking wallet prompts. The screen can say claim, verify, switch network, or confirm eligibility. The chain sees a transfer or a spending permission. If you approve it, the money does not come back with a ticket number. Crypto transfers are not like card charges. There is no bank in the middle that can reverse the rail.
The FTC’s crypto fraud spotlight put numbers on that rail. Since the start of 2021, more than 46,000 people reported losing over $1 billion in crypto to scams. That was about 1 out of every 4 dollars reported lost, more than any other payment method. The median individual reported loss was $2,600.
Those figures are older than this clone wave, and they are not a tally of Tari victims. They are the reason a free-token page can pay for ads. The median already dwarfs most airdrop daydreams.
Getting the stolen balance back is usually a dead end. Once the drain lands in an address the operator controls, the next hop can be a mixer, a bridge, a swap, or a deposit that is already being emptied. A quiet hour after you clicked is not proof that you got away clean. It is a reason to treat the wallet as burned until you finish the cleanup.
- The lure uses the Tari name and the XTM ticker.
- The real host is airdrop.tari.com.
- Any other host that looks close is a clone until you typed the official one yourself.
- The page asks you to connect a wallet to check eligibility.
- It also offers to let you claim tokens instantly.
- A connected wallet can be emptied by a crypto drainer.
- Crypto transfers generally cannot be reversed.
- Tari is a real project. The copies are not its portal.
- Type the official portal. Do not follow a lookalike from a feed.
How The Scam Works
Step 1: The airdrop arrives as an ad, a spam post, or a borrowed account
The clone does not need to hack Tari. It needs a crowd that already wants XTM. That crowd is easy to find. People who mine. People who missed a claim window. People who saw a friend post a screenshot. People who search “Tari airdrop” at 1 a.m. and click the first card that looks official.
The link travels on fake or stolen social accounts, including Facebook and X. It also rides hacked WordPress sites, junk advertising networks, torrent pages, illegal streaming sites, pop-ups, banners, embedded buttons, junk email, browser-notification spam, and adware. The costume changes. The destination does not have to. One lookalike can catch traffic from ten ugly roads, then die and be replaced by another.
Nearly half the people who told the FTC they lost crypto to a scam said the contact started with an ad, a post, or a message on social media. In that same window, Instagram accounted for 32% of those named platforms and Facebook for 26%. A Tari-shaped claim fits that pipe. It looks like news. It looks like a community drop. It looks like something you are late for.
If the post is in your feed, that does not mean Tari posted it. Compromised accounts keep their old profile photos. They keep their old followers. They keep the little bits of trust that make a stranger’s link feel like a friend’s tip. Read the destination, not the avatar. If the destination was handed to you, it is already doing the clone’s job.
Search traffic is part of the funnel too. People type the project name plus airdrop, claim, or XTM and click whatever looks closest. Junk ads and poisoned results love that habit. A paid card can sit above the official site. A lookalike can rank because it stuffed the same words. Type the official host. Do not let a results page choose it for you.
Step 2: A lookalike clone of the real claim portal
The landing page poses as the original Tari claim portal. It does not have to be a pixel-perfect twin. It has to be close enough that a person who has seen airdrop.tari.com, or who has only heard the name, accepts the room as the right room.
Lookalike domains are cheap. Register a host that contains tari, airdrop, and a serious-sounding extra word. Put a claim headline on it. Ask for a wallet. The visitor who types with their thumb will forgive the extra syllable. The visitor who is already in a hurry will not open a second tab to compare.
This is not a smear of Tari. The official portal is still the official portal. The official terms still live on that portal. The official project still has to answer how you know you are on the legitimate claim page, because that question is the entire defense against a copy. The clone is counting on you never asking it.
Cloning a real airdrop is more effective than inventing a fake token from scratch. A made-up ticker has to sell you on the story. A real ticker only has to sell you on the door. You already wanted XTM. You already heard there was a claim. The lookalike does not need to invent desire. It only needs to stand between you and the official host for one click.
That is why this family of pages keeps coming back. The real program exists. People keep searching for it. Operators keep standing up hosts that look like the search. When one domain gets reported, the template moves. Learn the official address. Do not learn a blacklist of yesterday’s clones.
Step 3: Connect Wallet becomes “check eligibility”
The dangerous sentence is the helpful one. Connect your wallet to check if you are eligible. Claim your tokens instantly. That is the documented ask on these clones. It is also the moment the page stops being a picture and starts being a drain.
Checking eligibility does not require a blank check. A public address can be read without emptying a wallet. A real program that needs to see whether you mined, completed a quest, or sat in a snapshot can do that from chain data and from accounts it already runs. It does not need a surprise approval that can move every token you hold.
The clone needs the connection because the connection is how the drainer gets a chance to speak. Wallet software will show a prompt. The prompt can look like a simple attach. It can look like a signature. It can look like a network switch. It can look like a claim transaction with a tiny fee. Read the prompt the way you would read a wire form, not the way you would dismiss a cookie banner.
If the request is blank, unlimited, unreadable, or different from “look up my address,” reject it. If the page wants a recovery phrase, stop immediately. No official airdrop needs the words that recreate the wallet. The documented move on this pattern is the connect-and-claim path, not a seed-phrase form, but a page that already lies about its host can lie about the next screen too.
A real check also does not need to happen on a stranger’s domain. If you already have an account on the official portal, open that portal by typing it. If you are not sure you are eligible, the official terms are the place to read, not a countdown on a host you met five seconds ago. Hurry is the clone’s favorite lighting.
Step 4: The drainer empties what the wallet will sign
After the wallet is attached, the malicious tool can transfer holdings to the operator. The holdings in that wallet are the target. The visitor still thinks they are waiting on an eligibility result. The chain is already moving value the other way.
Some drains are loud. The balance hits zero while you are still on the page. Some are quieter. An unlimited approval sits in the wallet. Hours later, when you top the account up or when a token you forgot about gets liquid, the same permission spends it. That is why “I connected but I did not see a send” is not a clean bill of health. The approval can be the theft. The transfer can wait.
The operator does not need your name. They need a destination they control and a signature you thought was a claim. After that, the money is theirs on the same public rules that make crypto useful. No chargeback. No “I did not authorize this” button that a network validator honors. The FTC said the quiet part out loud: once the money is gone, there is no getting it back on that rail.
Follow-up damage is part of the business. People who post about a drained wallet attract recovery agents. Those agents promise a tracer, a hacker, or a special backdoor at the chain. They want an upfront fee, remote access, or the new recovery phrase. That is a second scam standing on the first one. The clone already took what the wallet would sign. Do not pay a stranger to reverse a rail that does not reverse.
Step 5: Tomorrow’s clone will use a different hostname
When one lookalike dies, the template does not have to die with it. A new registration can swap one extra word, one prefix, or one suffix and reuse the same Tari costume. Learn the tell, not the one hostname that happened to be live when you read this.
The tell is stable. If the host is not airdrop.tari.com, it is not the official claim portal. If a page that is not that portal wants a wallet connection to check eligibility and then wants an instant claim, treat it as a drain until official channels say otherwise. Official channels means the portal you typed, the project site you typed, and accounts you already verified, not the link that arrived with the rumor.
Airdrops are not automatically scams. Real projects run real distributions, and Tari’s official portal is one of those. The clone is effective because the real thing exists. That is the unkind part. You cannot protect yourself by deciding every airdrop is fake. You protect yourself by deciding that only the official host is allowed to talk to the wallet.
If a friend forwards a claim link, do not argue about the screenshot. Ask whether they typed airdrop.tari.com. If they did not, the picture is not proof. It is bait with better lighting. Open a new tab. Type the official host. If the real portal does not match the rumor, the rumor was the product.
What To Do If You Have Fallen Victim to This Scam
- If you only opened the clone and did not connect a wallet, stop there. Close the tab. Do not go back to see whether the page still loads. Do not connect a throwaway wallet “just to look.” Looking is how people finish a prompt on a phone. If you need a second pair of eyes, send a screenshot with the link unclicked, or send the URL as text to a person you already know.
- Disconnect the site from the wallet. Open the wallet’s connected-app or connected-site list and remove the fake Tari XTM claim page, plus any other unknown sessions from the same sitting. Disconnect is not a full fix. It is the first door you shut so the page cannot keep asking for new signatures while you clean up.
- Create a new wallet on a device you trust. Use the official wallet app to generate a fresh recovery phrase. Write it down offline. Do not reuse the old words, and do not edit them. Every account derived from the old phrase can still be reached if a key or an approval is already in someone else’s hands. The new wallet is the only clean room you can still build.
- Revoke approvals and spending permissions from the old wallet. Use the wallet’s official approval manager or a reputable blockchain explorer for the network you connected. Remove unlimited token allowances, NFT operators, and anything tied to the clone. Revocation stops future spends that were pre-approved. It does not pull back coins that already moved, and it does not repair an exposed recovery phrase.
- Move remaining assets to the new wallet before the operator does. Start with the most valuable and most liquid tokens. Leave enough native coin on the old address to pay network fees. Verify each destination on the wallet screen, not in a message someone just sent you. Do not send more value into the old wallet to “test” a claim or to cover a supposed gas fee from the clone.
- Preserve transaction IDs and the rest of the record. Save TXIDs, destination addresses, token contracts, approval events, timestamps, screenshots of the clone, and balances before and after. Export what the wallet and the explorer will give you. This packet is what an exchange fraud team, a cop, an insurer, or a tax person can actually use. Memory is not a record.
- Report the clone and the drain. File at the FTC’s ReportFraud site if you are in a position to use it. Tell your wallet provider. Tell the registrar or host if you can identify them. Tell the social platform, ad network, or site that pushed the link. If stolen funds landed at an exchange deposit, send that exchange the TXIDs the same day. A freeze is not a promise. Delay makes it a fantasy.
- Ignore recovery agents, guaranteed tracers, and anyone who messages you first. A stranger who found your report is not your incident responder. Do not pay an upfront crypto fee. Do not install remote-support software. Do not hand over the new recovery phrase. Work with law enforcement, the exchange you already have an account with, or a firm you chose yourself. If you want a human walkthrough after the cleanup, use the MalwareTips support forum on a page you opened yourself.
If you never approved a prompt and you only attached the wallet for a second, still disconnect, still review approvals, and still watch the old address. If you approved anything you did not fully read, treat the old wallet as compromised even if the balance looks the same tonight. Drainers are allowed to be patient. You should not be.
Do not use the official Tari portal as a place to undo a drain. The official team cannot reverse a foreign chain transfer, and a support impersonator will pretend they can. Open the official Tari airdrop portal only if you already use it for a real claim you started there, and only by typing the host. Never paste a recovery phrase into any Tari-shaped page.
The Bottom Line
The fake Tari XTM airdrop is a clone of a real portal, not a review of a real project. Tari’s claim page is airdrop.tari.com. The copies add a serious-sounding extra word to the host, ask you to connect a wallet to check eligibility, and offer to let you claim instantly. The connected wallet is what they came for. The drainer is how they get paid.
You cannot check eligibility on a stranger’s host without giving that host a chance to talk to your keys. You check a real airdrop the long way: type the official portal, read the official terms, and refuse any extra hostname that showed up in an ad, a spam post, or a borrowed account.
If you already connected, disconnect, open a new wallet, revoke, move what is left, save the TXIDs, report the clone, and hang up on anyone who promises a guaranteed recovery for another payment.
Free XTM on the wrong host is not a reward. It is a price tag facing the wrong way. Next week’s clone will have a different hostname. The official address will not. Type it before the button does the rest.
