Home / Brand Protection / Phishing & impersonation
Phishing & impersonation
Phishing is a fake login page using your name. It steals your customers' logins and money. Our phishing takedown needs no letter of authorization (LOA) and takes 24 hours or more. We file the complaint on the day you confirm “not ours”.
Free. Delivered within 1 business day.
Phishing right now? Our 24/7 line on Telegram: @bc_team
What phishing looks like in igaming, crypto and fintech
iGaming
A fake login page for a casino account and a fake deposit page with your logo. The username, the password and the money go to the scammer.
iGaming →Crypto
Fake exchange and wallet logins take the username, the password and the seed phrase. One exchange's fake account page asked for a WhatsApp number and a Telegram username along with the password. After that, the scammers talk to the victim in these apps.
Phishing also targets partners. For the same exchange, we found a fake token listing platform. It targets project teams, not customers.
Crypto →Fintech
Copies of an online bank's login page and payment page. They take card details, confirmation codes and documents for identity checks.
Fintech →Your customer searches for your login page and enters their password on someone else's site
- “brand exchange login”
- Vietnam
- 2026-08-19
- position 18
- brand-exchange-login.compassword field · 8 buttons, none leave the site
We call a page phishing when its form takes passwords on someone else's domain. Looking like your page is not enough. Method →
How we find phishing
variants of one exchange's name checked, and 43 domains were live. Two of them were working fake login pages. They did not appear in search results for the brand name
The form, not the buttons
A fake login page links its buttons to your real site and takes the password with a form. Our button check marked such a page as “unrelated site”. So we look for the password field in the page code
Mobile search results
A page with a typo in the word “login” appeared only in mobile search results. It was not there on desktop
Warning lists are out of date
On one exchange's public phishing list, six of eight domains no longer worked. And two working fake login pages were not on the list
Phishing or your own login
Your addresses come first
Your login can be on a mirror, a country site or a single-use domain. For one brand, three visits to the home page gave three different addresses. We get your list before the first complaint. We check single-use addresses against your redirect.
The field tag, not the word
Phishing is a form that takes a password or a seed phrase on someone else's domain. We look for the field tag itself. On one site, the “password field” was just a line in the styles of a WordPress theme.
Your name alone is not phishing
We opened 35 pages with an exchange's name on free hosting by direct request. None of them had a password field. We don't call them phishing.
We take down the campaign, not one page
One naming pattern
Next to a fake exchange login page, two more domains appeared at the same registrar within 11 days. They follow the same pattern: the exchange name plus “app” and “reg”.
Certificate on registration day
The fake login page of another exchange got its SSL certificate on the day the domain was registered. If a new domain with your name is at a registrar already used for proven phishing, we check it first.
Random subdomains
One fake account page lived on a long random subdomain. A complaint about one address does not help, because the page moves. We file against the whole domain. The registrar then stops it together with all its subdomains.
A taken-down domain goes back on sale
A taken-down phishing domain expired and went to auction. With its history, it passes filters better than a new registration. We mark such domains in our report. You can buy them or get them through UDRP (the dispute process for domain names).
How we take down phishing
Cloudflare and hosting provider
the site goes offline. Cloudflare passes the complaint to the hosting provider and tells us its name
LOA: no
Registrar
the domain stops working together with all its subdomains
LOA: no
Google Safe Browsing
Red warning screen
the browser shows your customer “Deceptive site ahead” before they open the site
LOA: no
Google and Bing search results
median time from complaint to removal from search results
LOA: yes
We file with the hosting provider, the registrar and Safe Browsing on the day you confirm “not ours”. We file with search engines as soon as we have the LOA. Google removes the page from search results. The hosting provider and the registrar close the site. All channels and timelines → · All threats →
FAQ
Do you need an LOA to take down phishing?
No. We file phishing complaints with the hosting provider, Cloudflare, the registrar and Google Safe Browsing without an LOA. We need it only for Google and Bing search results.
Will the site close on the day of the complaint?
No, usually later. Hosting providers and Cloudflare take 24 hours or more, and registrars take up to 2 weeks. So on the same day we file with Google Safe Browsing. The browser then warns your customers while the site is still online.
Can you take down phishing behind Cloudflare?
Yes. Cloudflare passes the complaint to the hosting provider and tells us its name. Then we file with the hosting provider directly.
Will you take down phishing if the registrar does not reply?
Yes. If the registrar is silent, we take another route. We file with the hosting provider and Cloudflare, remove the page from search results and make browsers show a red warning before it opens.
See who's profiting from your brand
Send a request. Within 1 business day we'll show you who is making money off your name and what we can take down. Free.