Phishing Through Search Ads: Why the Top Result Can Be Fake

Scammers buy search ads for the names of popular wallets, exchanges and DeFi apps, so the first "sponsored" result can lead to a convincing fake site built to steal your seed phrase, login or wallet approvals. The safest habit is simple: never reach a crypto site through an ad, and use your own bookmarks instead.

This attack works because it targets a moment of trust. You search for a name you know, click the first result, and see a page that looks exactly right. Nothing feels suspicious — which is the whole point. This guide explains how the scheme works, what it looks like in practice, and how to protect yourself.

How Search Ad Phishing Works, Step by Step

1. 1The scammer registers a look-alike domain. It may swap a letter, add a word like "app" or "claim", use a different domain ending, or use characters that look identical to Latin letters.
2. 2They clone the real site. Copying the design of a wallet, exchange or DeFi app takes little effort.
3. 3They buy ads on the brand name. The ad targets searches such as the wallet's name plus "download" or the exchange's name plus "login".
4. 4They evade review. Tricks include showing a harmless page to reviewers and the phishing page to real visitors, or redirecting through several domains.
5. 5Victims click and act. The fake site asks for a seed phrase to "restore" a wallet, captures an exchange password and two-factor code, offers a malicious app download, or asks you to connect a wallet and sign a transaction.
6. 6Funds are drained. With a seed phrase or a spending approval, the attacker moves assets out within minutes, often through mixers or bridges.

The fake page usually disappears quickly, and a new domain with a new ad replaces it. We cover this in more detail in Crypto Loan Scams.

A Hypothetical Example

The following is a composite, illustrative scenario — not a real case.

Imagine Sam wants to check a DeFi position. Sam types the protocol's name into a search engine and clicks the top result, which is marked "Sponsored" in small text. The page looks identical to the real app. A banner says a "security migration" requires users to reconnect their wallet. Sam connects and is asked to sign a message that looks like a routine login. See also: Email Account Security for Crypto Users.

In reality, the signature is a token permit that grants the attacker permission to move Sam's stablecoins. Minutes later, the balance is gone. When Sam checks the address bar, the domain has one extra letter. Our explainer on ice phishing and permit signatures shows how these signatures work.

Warning Signs Checklist

How to Protect Yourself

Build safe access habits

• Bookmark official sites once, after verifying them carefully, and only use those bookmarks. Our guide on how to verify a website is the official project site covers the checks.
• Scroll past ads for any financial or crypto search. Better yet, avoid searching for login pages at all.
• Install wallet apps only from links on the official website or verified app-store listings, checking the developer name. See fake wallet apps for red flags.

Reduce the damage if you slip

• Use a hardware wallet that shows transaction details on its own screen, and read them.
• Keep most funds in a wallet you rarely connect to apps, and use a separate wallet for experimenting.
• Review and revoke token approvals regularly.
• Use an ad blocker or browser setting that hides sponsored results, if you are comfortable doing so.

Check addresses, not appearances

Read the domain in the address bar before typing anything. A perfect-looking page proves nothing; the domain is what matters. For a deeper look, see Supply-Chain Attacks.

What to Do If It Happened to You

1. 1Stop interacting with the site and disconnect your wallet.
2. 2If you entered a seed phrase, create a brand-new wallet with a fresh seed phrase and move any remaining funds immediately.
3. 3If you signed an approval, revoke it using a reputable approval checker, then consider moving funds to a new address.
4. 4If you entered an exchange login, change your password, reset two-factor authentication and contact the exchange's support through its official site.
5. 5Record evidence: the ad, the domain, transaction hashes and timestamps.
6. 6Report it to the search engine, the impersonated project and through our scam report form.

Our step-by-step guide on what to do immediately if your wallet is compromised covers recovery in detail. Be wary of anyone who then contacts you promising to recover funds — recovery scams target recent victims.

Bottom line

A top search position is something that can be bought, not proof of authenticity. Scammers use sponsored results to place look-alike crypto sites in front of people at the exact moment they are about to log in or connect a wallet. Verify official sites once, bookmark them, skip ads entirely, and never type a seed phrase into a website. Those habits make this entire class of attack irrelevant to you.