What a domain lookalike scan finds on four crypto exchanges
On 15 October 2026 a LookalikeDomain.com scan of four crypto exchanges found thousands of registered lookalikes. Hundreds can send mail. A smaller set already hosts a page that copies the brand.
Crypto exchanges get copied because a customer often reads the logo, the first familiar word, and then stops. On 15 October 2026 our LookalikeDomain.com scan checked binance.com, coinbase.com, kraken.com, and crypto.com against live domain registrations in major domain extensions.
The scan found 1,826 lookalikes of binance.com, 1,973 of coinbase.com, 1,395 of kraken.com, and 2,927 of crypto.com. The last list is longer because the label in crypto.com is the ordinary word crypto. Plenty of those names belong to other projects that happen to use the word.
A similar registration, a live page, and a page that is actually impersonating the exchange are three different things. The scan separates a registered name from a lookalike domain that is configured to send email or that has a website. Deciding that a page is impersonating the exchange takes a closer human look at the wording, the mail setup, and who operates the name.
Mail is how a lookalike reaches someone
A lookalike that can send mail is already useful to a phisher. The message can show Binance or Coinbase as the display name. The domain in the address is the copy. A person who trusts the display name, or who only glances at the start of the URL, can reply, click, or type a password. When that same name also has a website, the mail can point at a sign-in, a wallet prompt, or an app download on the lookalike itself.
There are 391 Binance lookalike domains that are configured to send email. There are 450 Coinbase lookalike domains, 427 Kraken lookalike domains, and 1,511 Crypto.com lookalike domains configured to send email. The Crypto.com count mixes in ordinary businesses that use the word crypto. There are 42 Binance lookalike domains with both email and a website, 40 Coinbase, 131 Kraken, and 56 Crypto.com. Kraken has more websites because other companies already trade under that word.
An SSL certificate only means the name answered on a secure connection. Certificates are common. Mail, and a page that copies the exchange, are the clues worth reading first.
Some names are only parked. A parked name has no page of its own yet. It can stay empty, or a fraudulent site can appear on it later.
Pages that already speak as the exchange
safewallet-binance.com can send mail, and the mail host is that same domain. The page is titled "Binance Support". binance-support.com can send mail too, again from itself. binance-server.com has a website titled "Binance | Cryptocurrency Exchange". com-binance.com titles itself as the official Binance entrance to a leading digital-currency platform. my-binance.com offers what it calls the official Binance app for bitcoin and ethereum. buyp2p-binance.com can send mail and sells what it calls flash USDT. b1nance.com swaps the i for a 1. It can send mail, and it has an SSL certificate.
userhub-coinbase.com has a website titled "Coinbase - Sign In". twofactor-coinbase.app is titled "Two Factor Coinbase" and can send mail through Microsoft 365. coinbase-referral.com can send mail and is titled "Coinbase - Get $10 for signing up". pay-coinbase.com can send mail from a host on that same name. colnbase.com swaps the i for an l and can send mail. c0inbase.org swaps the o for a 0 and has an SSL certificate.
crypto-verify.net is the clearest Crypto.com copy in this set. It can send mail from itself, and the page is titled "Secure Your Account - Crypto.com". crypt0.com swaps the o for a 0, can send mail, and has an SSL certificate. secure-crypto.com can send mail as well, and its title says the page is a phishing simulation. That is a useful reminder: a scary name still needs a person to read the page.
Kraken, and the other Krakens
kr4ken.com swaps the a for a 4 and sends the visitor to kraken.com. email-kraken.com and kraken-email.com do the same. kraken-pay.com sends the visitor to krak.app, Kraken's own money app. The scan shows the destination. A person still has to see who registered the name. It may be the exchange holding the lookalike, or someone else pointing it there.
krak3n.com swaps the e for a 3, can send mail, and is a customs shop in Easley, South Carolina. kraken-es.com is an events company on Microsoft 365. Those sites are live. They are other businesses that share the word.
crypto.com has the longest list, and kraken.com the shortest.
Of those names, 592 Binance matches ranked high, 618 Coinbase, 519 Kraken, and 630 Crypto.com. High means the spelling is close, or the name pairs the brand with a word such as login, pay, or support. Crypto.com has the most names and a smaller share of close matches, because so many of them only contain the word crypto. ccrypto.org is a research project called Cognitive Cryptography. crypto-pay.org is a payments product titled "Crypto-Pay". They are real sites. They are not copies of crypto.com.
How we counted
On 15 October 2026 our LookalikeDomain.com scan searched the Internet for live domain registrations in major domain extensions. The brand is the label before the dot, so binance.com is searched as binance and crypto.com is searched as crypto.
Every match in these four results was checked for DNS, for mail, and for a website. A name with an SSL certificate answered on a secure connection. Calling a result impersonation still takes the closer human look described above.
If you run this on your own domain, start with the names that can send mail and the pages that already use your brand in the title. A free lookalike check shows the top of that list. Monitoring is what tells you when a new one appears next week.