Phishing sites are the single biggest source of user losses in the crypto industry. This article breaks down 4 common types of phishing sites. The short version: spoofed domains plus cloned UIs are the most common form of phishing, search engine ads and social media promotion are the main distribution channels, and bookmarking the official domain directly instead of clicking search results is the most effective defense. For everyday use, register your main account through the Binance Official Site, install the Official Binance App on Android, and iOS users switching to an overseas Apple ID can check the Download Page.

1. Four Common Types of Phishing Sites

Type Target Distribution channel Damage level
Fake exchange login Steal login credentials + 2FA Search ads / tweets $10,000-$1,000,000 per account
Fake wallet extension Steal wallet seed phrases Chrome Web Store / phishing links Entire wallet balance
Fake airdrop page Trick users into approving malicious contracts Twitter / Telegram Partial tokens in wallet
Fake DApp site Trick users into signing malicious transactions Twitter / Discord Partial tokens in wallet

2. Type 1: Fake Exchange Logins

Typical spoofed domains:

Real domain Example phishing domain Difference
binance.com binnance.com Extra "n"
binance.com b1nance.com "1" replaces "i"
binance.com binance-vip.com Added suffix
binance.com mybinance.com Added prefix
binance.com binance.cm TLD swapped to .cm
okx.com okxx.com Extra "x"
okx.com okx-login.cn Added suffix plus .cn

Phishing site UIs are extremely convincing: most are built by scraping the entire front-end code of the real site and only redirecting the back-end API to a malicious server. Visually they're about 99% identical to the real thing, making them very hard to tell apart.

Typical phishing flow:

  1. The user searches "Binance official site" on Google or another search engine
  2. They click the ad in the search results (actually a phishing site)
  3. They enter their username and password (recorded by the phishing site)
  4. They enter their 2FA code (recorded in real time)
  5. The phishing site's backend immediately logs into the real Binance account with the stolen credentials, enters the captured 2FA code, and withdraws funds

Key defenses:

Q: How do I verify the real official domain for Binance or OKX?

Ways to verify the official domain:

  1. Binance's official domain: binance.com (global)
  2. OKX's official domain: okx.com (the old okex.com has been retired)
  3. Official Twitter/X accounts: @binance / @okx (blue checkmark)
  4. Check the SSL certificate: click the padlock icon in the address bar — it should be issued to Binance Holdings Limited or Aux Cayes FinTech Co. Ltd. (OKX)

Once you've bookmarked the official domain, always click the bookmark directly instead of relying on search.

3. Type 2: Fake Wallet Extensions

Phishing attacks targeting wallet extensions (MetaMask, Phantom) include:

1. Fake extensions listed on the Chrome Web Store

Scammers upload extensions with similar names (like "MetaMask Wallet" versus the official "MetaMask") with almost identical UIs. Once a user installs it and enters their seed phrase, the scammer captures it instantly.

A real case: In Q3 2024, an extension called "MetaMask Premium" appeared on the Chrome Web Store, was installed over 5,000 times, and led to roughly $2 million in stolen assets. It took Chrome 14 days to remove it.

Defenses:

2. Sites that ask you to "re-enter your seed phrase"

Malicious sites pop up messages like "Your wallet needs to be reactivated, please enter your seed phrase." Real wallets like MetaMask never proactively ask you to enter your seed phrase.

Defenses:

3. Fake mobile MetaMask apps

Apps with similar names (like "MetaMask Mobile," but published by a developer that isn't the MetaMask team) show up on the App Store or Google Play.

Defenses:

Q: Is the official MetaMask seed phrase entry screen actually safe?

MetaMask's official seed phrase entry screen is safe (the data is encrypted locally). But you should still:

4. Type 3: Fake Airdrop Pages

Airdrop phishing preys on users' desire to "claim free tokens."

Typical scenarios:

  1. A tweet: "$XXX airdrop is live, connect your wallet to claim!"
  2. A Telegram group: "Official airdrop event, 24 hours only"
  3. An email: "You have an unclaimed $XXX airdrop worth $5,000"

Phishing site UI:

After the user signs:

A real case:

In May 2025, a user on Twitter saw a link claiming "WLFI airdrop is live" (World Liberty Financial is a real project). After clicking it, they signed an Approve transaction that authorized a malicious contract, which then drained 8,500 USDC from their wallet.

How to spot it:

Key defenses:

Q: How do I find the real, official claim page for an airdrop?

Ways to verify an official airdrop:

  1. The project's official Twitter/X account (blue checkmark + a known account)
  2. The project's official Discord announcements channel
  3. DefiLlama Airdrops (aggregates airdrop information)
  4. The official links listed on the project's CoinGecko / CoinMarketCap page

Don't trust:

5. Type 4: Fake DApp Sites

These impersonate mainstream DApps (Uniswap, OpenSea, Aave).

Typical spoofed DApp domains:

Real domain Phishing domain
app.uniswap.org uniswap-app.com
opensea.io opensea-eth.com
app.aave.com aave-defi.com
curve.fi curve-finance.io

The dangers of a fake DApp:

  1. Signature traps: it looks like "approving a token swap" but is actually "unlimited token withdrawal"
  2. NFT phishing: it looks like "minting an NFT" but is actually "transferring NFT ownership"
  3. Price manipulation: trading at an extremely bad exchange rate (a user swaps 1 ETH for 100 USDC when the normal rate is 3,000 USDC)

A real case:

In December 2024, a user searched "OpenSea" on a search engine and clicked an ad that was actually a phishing site. While trying to buy an NFT, they signed a transaction that appeared to be "purchasing an NFT" but was actually "transferring the NFT to the attacker's address," losing a BAYC NFT worth roughly $120,000.

Key defenses:

Q: Is Rabby Wallet safer than MetaMask?

Rabby Wallet (built by the DeBank team) provides more detailed signature decoding:

Rabby is better suited for heavy DeFi users, though its user base is smaller than MetaMask's. Using MetaMask day-to-day and Rabby for DeFi is a common combination.

6. How Phishing Sites Spread

The main distribution channels for phishing sites:

1. Paid search engine ads

The top 3 results on Google or Baidu search pages are usually paid ad slots. Scammers run Google Ads for cloned sites, targeting keywords like "Binance official site" or "buy USDT."

Google's crypto ad policy:

2. Social media promotion

3. SEO manipulation

Scammers mass-produce cloned sites and use SEO tactics to reach page 2-3 of search results. Some of the top-5-ranked sites for search terms like "Binance official download" or "OKX registration" are spoofed sites.

4. Email phishing

Q: How do I spot a phishing email?

5 steps to identify one:

  1. Check the full sender address (not just the display name)
  2. Check the email domain: is it the official domain? (@binance.com, not something like @bnannce.com)
  3. Don't click links in the email: log in to the official site directly instead
  4. Check for the anti-phishing code inside the email: Binance and OKX let you set one, and legitimate emails will display it
  5. Delete suspicious emails immediately

7. Setting Up an Anti-Phishing Code

Major exchanges support setting up an Anti-Phishing Code.

Setting it up on Binance:

  1. Log into your Binance account
  2. Security settings → Anti-Phishing Code
  3. Set a 4-20 character string (e.g., "MyB1nance2026")
  4. Save

Once it's active:

OKX's anti-phishing code: A similar process, under "Security Center → Anti-Phishing Code"

Bybit's anti-phishing code: "Security Center → Anti-Phishing Code"

Best practices for your anti-phishing code:

Q: Can a phishing site steal my anti-phishing code?

Your anti-phishing code isn't stored in your password or your email, so it's very hard for a phishing site to obtain it. Even if your login credentials are phished, the anti-phishing code won't leak with them (unless you tell a scammer directly).

This is the core protection mechanism of the anti-phishing code: scammers can't forge it, so any "Binance email" that lacks your code is guaranteed to be phishing.

8. A Toolkit for Staying Safe

Recommended anti-phishing tools:

1. Browser extensions:

2. On-chain tools:

3. Browser settings:

Q: Are paid anti-phishing services (like Pocket Universe) worth it?

Paid anti-phishing services are valuable for frequent DeFi users:

But they're not very useful for users who only use CEXs day-to-day (internal CEX trades carry no Approve risk).

9. Emergency Steps After Getting Phished

1. Your wallet signed a malicious Approve

2. Your exchange account login was phished

Q: Can I actually get my money back after being phished?

Recovery rates:

Prevention is worth 100 times more than recovery.

10. Frequently Asked Questions

Q: Does an HTTPS padlock icon mean a site is safe?

No. HTTPS only proves the connection is encrypted, not that the site itself is legitimate. Phishing sites can buy SSL certificates too.

You still need to check:

Q: Is browsing in incognito/private mode safer?

Private mode only prevents local cookies from being saved — it doesn't protect against phishing. Visiting a phishing site in private mode still puts your assets at risk.

Q: Which is more likely to get phished, mobile or desktop?

Mobile is slightly safer:

Desktop is riskier:

But the core defense — "don't click search results, bookmark the official domain" — applies equally to both.

Q: Do phishing sites disappear on their own?

Phishing sites typically survive 3-14 days before being taken down through:

But 50-200 new phishing sites go live every day — it's a constant cat-and-mouse game.

Q: Is it safer to log in with a linked Google or Apple account?

It's safer in some situations:

But it introduces new risks:

The safest setup: an independent email, an independent password, Google Authenticator 2FA, and an anti-phishing code.

Q: What should I do if a phishing site asks me to "enter my private key"?

Any site asking for your private key or seed phrase is 100% a phishing site:

Close the page immediately and check your computer for malware.

Q: Can a phishing site's SSL certificate be verified as fake?

You can check it, but it's not fully reliable. Certificate types:

  1. EV certificates (green padlock, address bar shows the organization name): hard for phishing sites to obtain
  2. DV certificates (standard certificates): easy for phishing sites to obtain (free through Let's Encrypt)

Binance, OKX, and other major platforms use EV certificates, issued to clearly named organizations like "Binance Holdings Limited." If a certificate shows a personal name or an implausible organization name, it's phishing.

Q: Does a password manager's autofill feature protect against phishing?

Yes. Password managers (1Password / Bitwarden) will only autofill on a domain that matches exactly:

A password manager failing to autofill is itself a signal of phishing.

Data Sources

Risk disclaimer: This article is an independent third-party summary and does not constitute investment or legal advice. Phishing threats evolve constantly; all data is current as of April 2026.