A clone instead of the original: how a fake site outranks the real one in Google

You type the name of a well known crypto wallet into Google. The first result is an ad. You click it, because it is first. The page looks exactly as it should, the address matches, the brand matches, everything matches. Ten minutes later you have nothing. This is not an article telling you to be careful. It is an article about why the advice “check the address” stopped being enough in 2026, and what to do instead.

The numbers first, so the scale is clear

The Federal Bureau of Investigation (FBI) publishes an internet crime report every year. For 2025 it reports:

• 11.37 billion dollars in losses in cases involving cryptocurrency, 22 % more than the year before,
• 181,565 complaints with a cryptocurrency element, 21 % more,
• 62,604 dollars average loss per complaint,
• 18,589 people lost more than 100,000 dollars,
• people over 60 lost 4.43 billion dollars, more than any other age group.

For comparison, total reported internet crime losses for 2025 were 20.88 billion dollars. Cryptocurrency therefore makes up more than half of them. And these are only the cases somebody reported.

A narrower category can be tracked separately: wallets drained through a fraudulent website. Scam Sniffer, which measures these attacks on Ethereum compatible chains, reports for 2025 83.85 million dollars and 106,106 victims, with an average loss of 790 dollars. Against 2024, when the figures were 494 million and about 332,000 victims, that is a fall of 83 %. The authors themselves caution that part of the decline may mean attackers moved to methods that are harder to measure, rather than that they retreated.

This concerns Slovakia directly. During 2026 the National Bank of Slovakia repeatedly published lists of websites offering crypto services here without authorisation, and with one of them noted that some of the domains appear to have been generated with artificial intelligence and that the list probably does not cover every suspicious site.

Why the advice “check the address” stopped working

In August 2026 the ThreatLabz team at the security firm Zscaler analysed a campaign aimed at users of Ledger hardware wallets. Its course is worth describing in detail, because it explains why the usual advice fails.

1. A Google ad. A paid ad appeared in the search results. The address displayed beside it read google.com.
2. Google Cloud Storage. The click opened an address on storage.googleapis.com, that is, on Google's own infrastructure.
3. A redirect. From there the user passed through a page on Vercel, which sent them onward. The researchers found that the destination domain changed roughly every 15 to 20 minutes, which makes reputation based blocking impossible.
4. Google Sites. They ended up on a Google Sites page with the fraudulent site embedded in a frame (an iframe).

Let us sum up what this means for an ordinary person. The whole chain ran through genuine Google domains. There was no typo in the address bar, no suspicious domain ending, nothing that looking at the address could have revealed. The certificate was no help either: all those services have valid certificates, because they are real.

And the ad was bought through a verified account

This is the point guides tend to leave out. According to the analysis, the ad was paid for by a long standing advertiser account with a verified advertiser identity and no observed history of malicious ads, with a location given in Germany. The researchers accept that the attacker had probably taken the account over.

In other words: it passed Google's verification, because that account genuinely had passed verification. Years of trust built up by both the brand and the platform worked in the attacker's favour.

What the page itself looked like

The fake page offered downloads for Windows, macOS, Linux and mobile, then showed messages reading “connecting your device” and “initialising firmware update”, and finally, under the pretext of confirming ownership, asked for the recovery phrase.

Two details show how carefully it was built:

• The fields for entering the phrase autocompleted words from the official BIP-39 list, the same 2,048 words the real software uses. It looked like standard wallet behaviour.
• After the first entry the page reported an error and asked the user to enter the phrase again. The researchers found nothing that compared the two submissions. The error was fake, its only purpose being to capture the phrase a second time and check it against typing mistakes. Meanwhile the user was left with the impression that a normal validation had taken place.

The page also tracked mouse movements, keypresses and touches, so as to tell a real visitor from an automated analysis tool.

This is not an isolated case. The Security Alliance reported that phishing tied to malicious Google ads took more than 1.27 million dollars between 13 and 30 March 2026 alone. The same method has been documented against users of Trezor wallets.

Why a hardware wallet will not save you here

This is the most widely misunderstood part and it needs stating precisely. A hardware wallet protects very well against one thing: the theft of your private key from your computer. The key never leaves the device. A virus on your laptop cannot read it.

But attackers do not go after the key. They go after two other places, and both are out of the hardware's reach.

Route one: you enter the phrase yourself

If you type your recovery phrase into a field in a browser, the hardware wallet becomes entirely beside the point. You have just handed the attacker the very thing the device was guarding all along. From there they restore the wallet on their own machine, and the hardware sitting on your desk changes nothing.

Route two: you sign it yourself, willingly

This one is more insidious, because nobody asks for the phrase and everything happens “correctly”. You connect your wallet to a site that looks like a service you know, and it asks you for a signature. You confirm the signature on the device, just as you always do. The device signs what you told it to sign, because that is exactly what it is for.

The problem is what you are signing. It tends to be an approval that lets the attacker move your tokens:

• Permit and Permit2 are off chain signatures. They cost no fee, they do not look like a transfer of money in the wallet, and so they come across as harmless.
• approve and setApprovalForAll grant access to tokens or to an entire NFT collection.

The numbers bear this out. According to Scam Sniffer, the largest single theft of 2025, at 6.5 million dollars, was carried out with exactly this kind of Permit signature. Among the large cases, Permit and Permit2 accounted for 38 % of the losses by value.

On a small display you often see a string that cannot be read in any meaningful way. This is called blind signing. The device obeyed you perfectly. You simply gave it the wrong instruction.

Why a fraudster picks you in particular

It is not chance, and a data breach is often behind it. The textbook case is Ledger in 2020: an attacker reached the online shop's database through a badly configured access key, and what ended up on the internet was roughly 272,000 records with names, addresses and phone numbers of customers, alongside more than a million email addresses.

The breach did not endanger the cryptocurrency itself; no keys or phrases were in the database. The consequences were different, and they continue to this day:

• customers received waves of phishing emails and text messages sending them to enter their phrase on a fake site,
• some received threatening letters demanding payment in bitcoin,
• in 2021, addresses from the leak received physically tampered “replacement” devices in original packaging.

So the attacker is not firing blind. They know you own a hardware wallet and they know your name and address. That is why their email does not read like spam: it reads like a message from a company you really did buy something from.

What to check when the terms are missing

In our article on identifying unknown callers we wrote that it pays to read the terms, even when they are long and in a foreign language. The same holds for fraudulent sites, but in reverse, and that is exactly what makes it such a reliable test.

A legitimate service has to state those details. The e-commerce directive, and in Slovakia Section 4 of Act No. 22/2004 Coll., require a provider to state its name and registered seat, its tax identification number if registered for VAT, a contact email and phone number, the register in which it is entered and the supervisory authority, and these details must be easily and permanently accessible. For financial services an authorisation is added to that, and it can be checked in the National Bank of Slovakia's register of supervised entities.

With a scam, those details are missing. A fraudster cannot state them, because true ones would give them away and false ones can be disproved. So they simply leave them out. Go through the footer and the subpages and look for:

• a missing registered seat, company number and operator name,
• terms that are not there at all, or are a link to nowhere,
• terms plainly copied from elsewhere: a different company name in the text than in the footer, a different country, a different currency, leftovers of another language,
• contact only through a form or Telegram, with no address and no phone number,
• machine translated text alongside otherwise professional design.

If the terms are in a foreign language, paste them into a translator. Do not give up on them because they are long; it is enough to look for the company name and address. When those do not match the brand you believe you are visiting, you have your answer.

The sentence we hear every single time

When we get onto this subject with clients, almost always the same reaction comes back: “That happened to somebody else. I am careful, it would never happen to me.” We can promise you we have heard it every single time.

And more than once, some time later, a phone call came that began with the words “listen, this and this has happened to me”. The same person, the same line about being careful, a different tone of voice.

We are not writing this to put anybody down. We are writing it because feeling careful is not a defence. Nobody falls for a scam that looks like a scam. The attack described above is built precisely so that a careful person walks straight through it: the ad was verified, the domain belonged to Google, the certificate was valid, the page autocompleted the right words from the right list. Caution had nothing to catch hold of.

That is why what follows is a list of rules, not an appeal to be careful. A rule works at the moments when caution does not: when you are tired, when you are in a hurry, when the screen insists this is an urgent update, and when everything else about the page checks out. That is exactly the moment the attack is designed for.

A routine that works against everything above

1. Never click a paid result for financial services and wallets. Ads are at the top because somebody paid for them, not because they are genuine. Scroll down to the unpaid results.
2. Type the address by hand or save it as a bookmark and use only that bookmark. This single measure would have stopped the entire campaign described above.
3. Download software only from the manufacturer's official site, reached through your own bookmark.
4. Never enter your recovery phrase anywhere but the device. Without exception, no matter how urgent the message on screen.
5. Read what you are signing. When you do not understand what is on the display, do not sign. A legitimate operation will wait; a fraudulent one is in a hurry.
6. Revoke old approvals regularly. An approval granted long ago stays valid until you revoke it.
7. For larger amounts use a separate wallet that never connects to websites at all.
8. Check the provider in the register of supervised entities of the National Bank of Slovakia before you send it any money.

What to take away

Advice of the “check that the address is correct” kind was written when fraudulent sites sat on typo domains with invalid certificates. That era is over. Today's campaign runs through a genuine Google domain, with a verified advertiser, and a destination that changes every twenty minutes.

Two things still work. The first is not trusting the route by which you arrived at the site, and going there by your own bookmark instead. The second is to read: the terms, the identification details and whatever you are being asked to sign. With a legitimate service you will find them. With a scam there will be nothing there, and that is precisely the information you need.

Related reading

What can be read out of the terms of an ordinary mobile app, and why it concerns people who never installed it, is covered in An unknown number is calling: how caller ID services work and what you hand over for them.

The same approach, verifying before signing rather than trusting an impression, is set out for choosing a supplier in How to vet a development partner: ten questions before you sign.

And if you want to know whether your own website exposes visitors to needless risk, our Free audit will show which third party scripts run on it and what they send.