Home / Resources / Blog / A “blank page” that posed as a login
A “blank page” that posed as an exchange login
In a scan for one crypto exchange, an automatic check marked six sites as “empty page”. We opened all six directly. Three of them posed as the exchange's sign-in page.
Article · Crypto · October 17, 2026 · 4 min read
By Vlad Pivnev, Founder & CEO
What was behind six “empty” labels
A parked domain is a domain with nothing on it. Such a label looks harmless, so a check moves on to the next site. We don't trust it. We sent a direct request to each of the six sites. All six responded like live pages.
AddressesLabelDirect checkWhat it was
3empty pageanswers“Sign In to … Exchange”
2empty pageanswers“403 Error”, 322 bytes
Three sites were on a free hosting service, pages.dev. Their titles read “Sign In to … Exchange”, “… Exchange Platform” and “… Global Exchange”. The text copied how the exchange talks about itself. These three pages had no login form. Still, you learn whether a page asks for a password only by opening it. A working fake sign-in page steals the login and the password. For a wallet, it asks for the seed phrase.
Two more sites returned a 322-byte “403 Error” stub. A stub is an access-denied page, not an empty page. Both domains were registered on the same day, June 11, 2026, at the same registrar. Their names were the exchange's name plus “app” and “reg”. We marked them “not determined”, not “clean”.
Four kinds of “empty” that are not empty
The exchange is not the only case. An empty result can hide a live page in several ways.
“Loading…” and nothing else
The page code contains only the word “Loading…”. A script renders the content later, in the browser. A simple request gets an empty page.
One page for Google, another for people
For another exchange, 13 sites served our browser an empty page. One of them, a hacked government site, showed Google a page about the exchange. This trick is called cloaking.
A placeholder for strangers
Some sites show a placeholder to visitors who don't look like customers. So we visit from a phone, with an IP address in the site's country and a link from Google.
A failed connection
Sometimes the check can't connect at all. That means nothing was checked. We mark it “not checked” and check the site again.
Our rule: “empty” means “not determined”
“Not determined” is not “clean”. A site that hides better is usually more interesting. So every empty result goes through the same steps.
| Step | Result |
|---|---|
| We open the site with a direct request, outside the scan | any response: not determined |
| We open it as Google and as a customer from the site's country | two versions compared |
| We look for a password or seed phrase field in the page code | phishing or not |
| We check when and where the domain was registered | date and registrar |
| We file the complaint on the day you confirm “not ours” | same day |
The rule works across scans. In a scan for one casino, 13 identical sites got the same “empty page” label. All 13 were live. Eight of them sent customers to the casino, and three to competitors.
We keep the label “parked” only for a site that does not respond at all. A phishing complaint needs no letter of authorization (LOA). We file it with the hosting provider, the registrar and Google Safe Browsing.
FAQ
Is a parked domain with our name safe to ignore?
No. We watch an empty domain with your name until a site or email appears on it. Some “empty” pages are live already: in one scan, three of six posed as a sign-in page.
Can you take down an empty domain with our name?
Yes, through UDRP, a domain dispute process without going to court. The domain is transferred to you in about 2 months. This needs the trademark owner's LOA.
Do you need our LOA for a fake sign-in page?
No. A phishing complaint is about what the site does, so it needs no LOA. We file it on the day you confirm “not ours”.
Related pages
We recheck every empty result before we call a site clean. Phishing pages using your name are taken down in 24 hours or more.
Phishing & impersonation → · Fake websites & clones → · Crypto → · Get a free brand audit →
Related articles
Takedown · 4 min read
Why a clone comes back after a takedown
Clone domains are disposable. We take down the whole network, then fill search results with your content.
Affiliates · 4 min read
127 domains, 2 affiliate accounts: how one ID shuts down a network
Affiliate fraud looks like a hundred sites. Close the account behind it, and the network stops earning.
More from Vlad Pivnev
SEO agencies · 4 min read
Your SEO agency's sites look like clones
Agencies build look-alike sites using your name. Nothing technical sets them apart from clones, so we ask first.
Decloaking · 4 min read
The money link hidden in a script
Buttons without links, plugins that intercept the click, paths inside scripts. We judge by where the customer lands.
See who's profiting from your brand
Send a request. Within 1 business day we'll show you who is making money off your name and what we can take down. Free.