Exchange impersonation domains
How many new domains carrying an exchange, wallet or dApp name appear, counted from certificate transparency logs. Domain names are not listed — counts only.
New domains carrying a name (DechoNet CT stream)
Korean exchanges
| Name | Last 7 days | Last 30 days | Judged dangerous | Judged suspicious | Latest |
|---|---|---|---|---|---|
| Upbit | 16 | 76 | 0 | 0 | 2026-10-31 |
| Coinone | 18 | 39 | 0 | 0 | 2026-10-30 |
| Bithumb | 12 | 31 | 0 | 0 | 2026-10-30 |
| DigitalX (formerly Korbit) | 4 | 13 | 0 | 0 | 2026-10-28 |
| GOPAX | 4 | 4 | 0 | 0 | 2026-10-31 |
Global exchanges
| Name | Last 7 days | Last 30 days | Judged dangerous | Judged suspicious | Latest |
|---|---|---|---|---|---|
| Binance | 236 | 236 | 0 | 0 | 2026-10-31 |
| Coinbase | 183 | 183 | 0 | 0 | 2026-10-31 |
| Bybit | 178 | 178 | 0 | 0 | 2026-10-31 |
| OKX | 120 | 120 | 0 | 0 | 2026-10-31 |
| Bitget | 70 | 70 | 0 | 0 | 2026-10-31 |
| KuCoin | 56 | 56 | 0 | 0 | 2026-10-30 |
| Gate | 7 | 7 | 0 | 0 | 2026-10-31 |
| Kraken | 5 | 5 | 0 | 0 | 2026-10-31 |
Wallets
| Name | Last 7 days | Last 30 days | Judged dangerous | Judged suspicious | Latest |
|---|---|---|---|---|---|
| MetaMask | 124 | 124 | 0 | 0 | 2026-10-31 |
| Trezor | 65 | 65 | 0 | 0 | 2026-10-31 |
| Ledger | 57 | 57 | 0 | 0 | 2026-10-30 |
| Trust Wallet | 51 | 51 | 0 | 0 | 2026-10-31 |
| Rabby | 7 | 7 | 0 | 0 | 2026-10-30 |
| Phantom | 4 | 4 | 0 | 0 | 2026-10-31 |
dApps and NFT markets
| Name | Last 7 days | Last 30 days | Judged dangerous | Judged suspicious | Latest |
|---|---|---|---|---|---|
| Uniswap | 75 | 75 | 0 | 0 | 2026-10-31 |
| OpenSea | 33 | 33 | 0 | 0 | 2026-10-31 |
| Hyperliquid | 31 | 31 | 0 | 0 | 2026-10-30 |
| Aave | 21 | 21 | 0 | 0 | 2026-10-30 |
| Jupiter | 0 | 0 | 0 | 0 | — |
Domains whose certificates appeared in certificate transparency logs with the name in them. A name in a domain is not proof of impersonation. Dangerous and suspicious count the domains someone checked with DechoNet's phishing check that got that verdict.
How we count
- Every new certificate is recorded in public certificate transparency (CT) logs. DechoNet reads several public CT logs itself, every minute, and picks out certificates carrying a name.
- A name counts only at a word boundary: part of an ordinary word, like "opensearch", is not counted.
- Official domains and their subdomains are not counted.
- Korean exchange names are tracked as impersonation candidates; global names are kept as counts for 30 days.
If you run an exchange or a project
Get told about a new domain carrying your name as soon as its certificate appears, with its front page opened to see whether it poses as you. Available in Brand Protection, with evidence packs and report drafts.
See Brand Protection →DechoNet never holds or moves assets and gives no investment opinion. It does not ask for a seed phrase or private key — anyone who does is not us.