Home / Resources / Open reports / Crypto
Phishing, clones and parasite pages targeting crypto brands
Who appears in Google for the names of 3 crypto exchanges and 1 DeFi protocol in 22 countries. Data from August 10 to September 9, 2026.
of searches for a crypto brand's name: the first result in Google is not the brand's own site
of results for the names of two exchanges were pages on open platforms, like code repositories and Q&A sites
phishing sites using a DeFi brand's name from a public wallet blocklist appeared in Google in our check
The first result is not the brand's site: by country
10 countries where we checked 3 or 4 brands
| Country | Brands | Brand not first |
|---|---|---|
| Japan | 3 | 70% |
| Germany | 3 | 68% |
| South Korea | 3 | 63% |
| India | 3 | 63% |
| Vietnam | 3 | 62% |
| Taiwan | 3 | 62% |
| United States | 4 | 59% |
| Turkey | 4 | 57% |
| Brazil | 4 | 56% |
| United Kingdom | 3 | 49% |
Brand by brand
We do not name the brands
| Brand | Searches | Brand not first | Open platforms |
|---|---|---|---|
| Exchange 1 | 793 | 56% | 12% |
| Exchange 2 | 779 | 80% | 12% |
| Exchange 3 | 665 | 48% | 5% |
| DeFi protocol | 602 | 39% | 5% |
| All four | 2,839 | 57% | 9% |
The name of exchange 2 also belongs to several other organizations. They hold some of the top spots.
A page that calls itself the official login
- “brand login”
- Taiwan
- 2026-08-18
- position 3
- brandlogin.github.io/en-es/“Official Brand Exchange Login Account”
The page is on a free code hosting service. It was in positions 3–7 for login searches in 12 countries. When we checked, the platform had already removed it, but Google still showed it. We did not see its form, so we do not count it as phishing.
Who uses the names of exchanges and DeFi protocols
Fake sign-in pages
For one exchange, we found 4 fake sign-in pages. 3 of them had a password field. One domain got its certificate on the day it was registered. A fake trading dashboard asked for a WhatsApp number and a password.
Pages on open platforms
Code repositories, Q&A sites, blogs and other companies' help centers. People publish pages there with referral codes and “official login” links. For two exchanges, this was 12% of all results.
Verified accounts for sale
One exchange had 15 sites and 150 findings that sell verified accounts. This is a way around KYC, the identity check. It's a regulatory risk, not lost traffic.
Access from sanctioned countries
For one exchange, the largest search demand comes from a country where it cannot serve customers. Local sites sell access and a paid “instant verification”.
Hacked government sites
Google gets a page about the exchange. A person gets an error page, the normal site or a redirect to a WhatsApp group. We confirmed this on 4 government sites for 3 of the 4 brands. Hacked government sites →
Copies of the whole site
10 domains showed an exact copy of one exchange's home page under one shared certificate. That certificate led us to a network of 64 domains. We file only after the brand says “not ours”.
Phishing often never appears in Google
A phishing site lives for days and gets visitors from ads, messages and social media. For one exchange, we knew of 12 live lookalike domains. 8 of them never appeared in search results, and both phishing domains with a password form were among them. So we also check lookalike domains and public blocklists. Phishing & impersonation →
How we collected the data
Sample
- 3 crypto exchanges and 1 DeFi lending protocol, 22 countries.
- 293 search queries with a brand name: the name alone, login, app, referral code, KYC, reviews and “scam”.
- 2,839 Google searches: 1,424 on desktop and 1,415 on mobile. In each one, we checked the first 100 results, 110,972 results in total.
- We opened 380 third-party sites in a browser and clicked their buttons.
- We also checked lookalike domains, certificates and a public phishing blocklist. Before we call a domain a clone, we ask the brand.
- This is a snapshot as of the dates we checked. Google changes its results every day.
What is not included
- Russia is not included: our tool does not cover it. For two of the four brands, it is one of the top two countries by demand.
- Iran is covered by one province only, not the whole country.
- We could not get the results of 126 searches. They are not in the count, and we do not count them as “clean”.
- We opened 380 of 4,444 third-party sites in a browser. The rest are “not checked”, not “clean”.
- Ads in Google, fake social media accounts and fake apps are not in this report.
- We do not name brands or sites.
Brand Protection for crypto → · Method → · The same check for your brand, free →
See who's profiting from your brand
Send a request. Within 1 business day we'll show you who is making money off your name and what we can take down. Free.