How to tell a real exchange site from a clone

05 September 2026

A real exchange site resolves to the domain you typed; a clone does not. The difference is usually visible within ten seconds if you look at the wrong things first, and invisible until it is too late if you only look at the logo and the layout.

Clones are copies of the real site's front page, often identical down to the footer links. They are registered on domains that differ by one character, a swapped letter, a hyphen, or a different TLD. The attackers rely on you typing fast or clicking a search-ad result without checking the URL bar.

Check the domain, not the page. The most reliable test is the address bar. Read it left to right. The real domain for this site is zebusolana.com. A clone might be zebusolana.net, zebus0lana.com (zero for o), zebu-solana.com, or zebusolana-exchange.com. If the domain does not match exactly, close the tab. Do not click anything on the clone page, even to "verify" anything - clicking can trigger a wallet-connect request or a clipboard hijack.

Check the SSL certificate, but know its limits. A real site has a valid SSL certificate; the padlock in the address bar will show as secure. But clone sites also buy cheap certificates. The padlock means the connection is encrypted, not that the site is legitimate. A missing padlock is a strong warning. A present padlock is not a pass.

Check the age of the domain. Use a WHOIS lookup service (many are free). A real exchange that has been operating for years will have a domain registered more than a few months ago. Clone domains are often registered days or hours before the attack. If the domain was created last week and the site claims years of service, it is a clone.

Check for typos and mismatched branding. Look at the small stuff: the copyright year, the support email, the social media links. Clones often copy old versions of the site, so the copyright year may be wrong. They may use a generic email like [email protected] instead of the real contact. Hover over any link (do not click) and check the URL in the status bar. If a "FAQ" link points to an address that is not the real domain, that is a clone.

Check the wallet-connect prompt. A real site will ask you to connect a wallet only when you initiate a swap. A clone may ask you to connect immediately, or to enter a private key, crypto-news-literacy/hardware-wallet-seed-phrase-phishing/">seed phrase, or "approve" a contract you did not request. No legitimate exchange asks for your private key or seed phrase. If the site asks for those, it is a clone or a scam regardless of how the page looks.

Check search results, but carefully. If you are unsure, search for the exchange name in a search engine. The real site usually appears first in organic results (not ads). Clones often buy ad placements that appear above the real result. Look for the verified checkmark or the official domain in the search snippet. But do not click the ad - type the domain manually.

What to do if you suspect a clone. Do not interact with the page. Close it. If you already connected a wallet, revoke any token approvals through a block explorer or a revocation tool (do not use the clone site for this). If you already sent funds, they are likely gone - the clone's deposit address belongs to the attacker. That situation is covered in the sibling page "Which mistakes in a swap are recoverable and which are not."

The most important habit: always type the domain yourself from a trusted source, such as a bookmark or the official announcement channel. Never click a link from an email, a social media DM, or a search ad. If you are about to send a large amount, the extra step of verifying the domain is worth the minute it takes. For a complete workflow including what to check after you land on the right site, read the hub page "Swapping crypto safely."

Back to crypto news