Is a fake site copying my crypto exchange or wallet?

Crypto brands are copied because one mistake by a user can't be undone: a password typed into a copied sign-in page, or a wallet's recovery phrase typed into a fake "restore wallet" page, can empty an account for good. The first step is finding out which lookalikes of your domain already exist and which of them show a live page.

Free, no account needed. A scan takes 15 to 60 seconds. You get a shareable result link.

What our crypto scans found

In October 2026 we scanned 13 well-known crypto exchanges and wallets (for example Coinbase, MetaMask, Binance and Trezor) with the same scanner you can use above. Counted from the stored scan data:

• 4,489 registered lookalike domains across the 13 brands, a median of 292 per brand.
• 15 confirmed fakes among the 735 flagged sites we checked by hand, at 8 of the 13 brands (no single brand had more than 4).
• What the fakes showed: 3 copied an exchange's trading screens or homepage, 2 copied a sign-in or create-account page, 1 was a fake swap app with a "Connect Wallet" button, 1 asked visitors for their 12-word wallet recovery phrase, 2 were unofficial "official download" portals for an exchange or wallet app, 3 presented themselves as the brand's own site or store, and 3 were blocked by Cloudflare as suspected phishing or malware.
• 14 of the 15 used the brand name spelled correctly, with an extra word or a different ending, rather than a misspelling.
• All 15 fake domains were less than a year old (we could see a registration date for every one).
• 36% of the crypto lookalikes had a real mail server set up, and 65% were found because they got a new HTTPS certificate in the previous 24 hours.

The full breakdown, method and limits are on lookalike domains by industry and our 95-brand research.

Signs a lookalike is after your users' funds

• Your brand name in the domain with a word like "app", "wallet", "login", "restore", "download" or "official", or a different ending.
• Your page title or site icon on a page you don't run, especially a sign-in, trading or "connect wallet" page.
• A recently registered domain or a brand-new HTTPS certificate.
• A working mail server, so it can send "security alert" emails under a name that looks like yours.

Our scan checks all four automatically: it compares each live lookalike's title and site icon with your real site, looks up registration age, watches public certificate logs, and checks for a real mail server. It can't connect a wallet, log in or test what a form does with what's typed into it, so a site we flag still needs a quick look by a person before you act.

If you find one

1. Save evidence: screenshots of the page and the address.
2. Report it to the domain's registrar and hosting company, and to Google Safe Browsing so browsers start warning visitors.
3. Remind your users which addresses are really yours, and that you will never ask for their recovery phrase.

Step-by-step details are in what to do about a fake domain. New lookalikes appear every day; monitoring re-checks daily, watches new certificates around the clock, and emails you when a new lookalike appears or an existing one gets riskier.

What it does not do

LookalikeGuard is monitoring and early warning. It does not take down domains, send legal notices, or give legal advice. Scores are automated and can be wrong in both directions: a high score is a reason to look, not proof of abuse. Many lookalike domains are parked, owned by unrelated businesses, or registered defensively by the brand itself; you can mark those as yours or dismiss them.