A copy of an exchange's website can look identical to the real one. What differs is the domain in the address bar. Paste the URL or domain you're about to open, and it is compared character by character with the official domains of the five exchanges built into the tool. The result tells you whether it is an exact match, close but not identical, or not on the list.
A full URL with https://, a path or www can be pasted as it is; the tool takes out the main domain before comparing. The comparison is done in your browser and the address is not uploaded.
What this tool can and can't check
What it checks is one thing: whether the domain you enter is identical, character for character, to the official domain of one of the five exchanges in the table below.
What it can't check: whether a site outside the table is real or safe. A “match” only means the domain is written the same way; it is not a certification or guarantee of the site. If the link came from someone pressing you to log in, don't open it even when the domain matches. Go in from a bookmark you saved yourself. For an exchange's current domains, its own official announcements are what count.
The official domains built into the tool
The tool holds the official main domains of the five exchanges below. An exchange that isn't listed is not illegitimate for that reason; it is just not on the list. To judge whether a platform itself is legitimate, see How to Tell If a Crypto Exchange Is Legit: 5 Checks.
| Exchange | Official main domain | Note |
|---|---|---|
| OKX | okx.com | Defer to OKX's official announcements |
| Binance | binance.com | Defer to Binance's official announcements |
| Coinbase | coinbase.com | Defer to Coinbase's official announcements |
| Kraken | kraken.com | Defer to Kraken's official announcements |
| Bybit | bybit.com | Defer to Bybit's official announcements |
Note: an exchange may also run regional sites or subdomains; its own official announcements are what count. The table lists main domains only and is not a certification or recommendation of any platform.
How each of the three results is reached
The tool first strips the https://, the path, the query string and the port from the address to get the main domain, then compares it with the table:
- Exact match: the main domain is identical, character for character, to one in the table. A subdomain under it also counts as a match, with a reminder to look at the prefix once more.
- Close but not identical: it is one or two characters off one in the table; or the name is the same and the ending differs; or the address contains an exchange's name but the main domain is not the official one. If the domain contains non-English characters, a separate note warns that lookalike characters may be standing in for letters.
- Not on the list: neither of the above. This result does not say the site is fake, and does not say it is real.
The “close but not identical” result is aimed at domains written like these (made-up examples, not real sites): a swapped character (0kx.com, with a zero for the letter o), a different ending (okx.net), an added word (okx-login.com), the exchange's name moved into a subdomain (okx.account-login.com), or a letter from another alphabet that looks the same. If you have already typed a password into a copy of the site, the steps are in Scammed in Crypto? What to Do and Where to Report It.
After checking once: how to avoid checking every time
- Once the domain checks out, save it as a browser bookmark and go in only from the bookmark from then on. No searching, and no links sent by other people.
- Keep the login in a password manager: it fills in only when the domain matches exactly, and offers nothing on a lookalike site.
- If a message says “the official site has moved” or “here is the latest backup address”, don't open it. Look it up yourself in the exchange's official announcements.
If it's the whole situation you're unsure about and not the address, use the scam self-check.