Phishing link of Uniswap on Google site.

[Asiska02]

Scammers are hosting sites on site.google.com and from there, they promote the website to Google ads directly sponsored. When you search for the website on google, the sponsored ads comes before the real website.

Here is one example, I searched for Uniswap on Google and I was shown this below.

This is something to take note of when trying to access a website and the pop out shows like this. I have not really tried to use the first result of Google sponsored ads whenever I search for anything online. I see them as ads and won’t really give me the best result I want, so I scroll down to the first website link showing after the ads.

Thanks for bringing this up that Google sponsored ads can also contain phishing websites imitating the original ones. Getting an ads blocker will be good at this point, I don’t know of any suitable ads blockers for mobile users, either android or apple mobile users that are good to use. Any suggestions?

[The Cryptovator]

When you are going to deal with something that's financially related, then don't trust Google search. Whoever paid to Google, they will always show them in the first line; it doesn't matter if it's phishing or scam links. If you don't know the exact website to browse, then try to find the trusted sources. For example, if you want to find a coin's official website, you may simply find it on CoinmarketCap; also, you can find exchanges there the same way.

You can bookmark some important links that you often need to visit if you can't memorise them. So you will be safe when browsing them. I always try to type the address when I need to visit important links like a hardware wallet's website. So we need to be careful to secure our funds.

[MisFoxie]

I'm not Against google but i think google have to be more careful, google mostly review ads automatically. Sometimes google manually or randomly check ads. If something slips through like the fake Uniswap it can still be removed later by scans or user reports.You know hackers/scammers are always trying their best to find bugs and exploit them. We also have to be careful and we should always double or triple check sites especially ones like Uniswap where we connect our wallets.

[sokani]

The sponsored malicious website is on top of the real Uniswap website, which makes the chances of people falling for the scam higher if they do not know the differences between the real and fake websites or if they do not pay attention to little details. Google is really doing a shitty job, and I wonder what it would cost to scrutinize every service before they are advertised on the platform. I guess because it is the biggest search engine and holds about 90% of the market, so it does not care about improvements or making the platform better.

[Kagaru]

The sponsored malicious website is on top of the real Uniswap website, which makes the chances of people falling for the scam higher if they do not know the differences between the real and fake websites or if they do not pay attention to little details. Google is really doing a shitty job, and I wonder what it would cost to scrutinize every service before they are advertised on the platform. I guess because it is the biggest search engine and holds about 90% of the market, so it does not care about improvements or making the platform better.

This has been an issue long enough. Google does not appear to have a problem with it as they continue to get money on advertisements. I think the true defence is the ability to remain conscious. people must look twice in the domains and bookmark the official site as opposed to search results. Crypto users are easy targets for this kind of trick and unless regulators force changes I doubt Google will prioritize fixing it.

[Mrbluntzy]

How to go about this kind of scam is to bookmark the real website of every platform that you frequently make use of, bookmarking it will prevent you from searching for the website on google when you want to access the website. Some newbies that have not access the website before can be a victim so I guess the best way of searching for the website of a platform is to ask for "official website of ---- platform" If you search with that keyword, it will give the specific website.

[tabas]

That's scary, there could have been victims already of that fake uniswap. People will just go on with that if the link is google and they'd believe it's a legitimate one. Just report it to google so that they'll remove it later on. We need collective effort to do this and every phishing link that we see, we can volunteer to report them individually.

This is how to report this phishing link and the others: https://safebrowsing.google.com/safebrowsing/report_phish/

Code:

Status of submission
Submission was successful.

I hope that everyone do it.

[Davidvictorson]

You can see the fake website at the top shown sponsored. It direct you to this website:

Code:

https://sites.google.com/view/apdfaz/uniswap

Real website: https://app.uniswap.org

Don't rely on google for real links, it can be misleading sometimes.

Lol, are you just finding out about this?

This is an open secret...and a warning to those who do not already know, most of the sponsored links that appears as the first result in the page of your Google search are scams. DO NOT CLICK ON THEM.  This is free cyber security tip for you all.

Even Google knows this. Lastly, do not act surprised. I stopped being surprised when Google Playstore allows bad apps on their app store.

[Iamgoat]

You can see the fake website at the top shown sponsored. It direct you to this website:

Code:

https://sites.google.com/view/apdfaz/uniswap

Real website: https://app.uniswap.org

Don't rely on google for real links, it can be misleading sometimes.

Lol, are you just finding out about this?

This is an open secret...and a warning to those who do not already know, most of the sponsored links that appears as the first result in the page of your Google search are scams. DO NOT CLICK ON THEM.  This is free cyber security tip for you all.

Even Google knows this. Lastly, do not act surprised. I stopped being surprised when Google Playstore allows bad apps on their app store.

Bro, it is insane the extent these scammers go to achieve their goals of swindling people. This is just a clear cut reason to why the internet is not as safe as people thought even when you are dealing with the giants like Google, you still have to be extremely cautious. Scammers now go to the extent of paying for google ads placements just to get their websites to appear at the top of the google search engine as if it is a legitimate website. Only few people have the knowledge of the SEM (search engine marketing) where individuals pay google to get their websites shown at the top bar of the google search engine. It is frustrating to see how google allow these websites to slip through but in the end, we are our own first line of defense because you are the one affected. I don't  have the best tips on how avoid these scammers but my advice is always double check on links before clicking them and any link you're not sure of, don't bother to click on it at all.

[Emjay24]

this is especially true for anything which I will connect to my personal wallet.

Connecting your personal wallet to these sites would still expose you to risks of social engineering on those wallets, it is better you have a separate wallet you can connect to these Dex platforms and only send funds from your personal wallet to the service wallet each time you want to effect a swap. Better if you use a cold storage for your personal wallet and send funds from there to your hot wallet which you can connect as you wish and is less risky since only very limited funds should exist on those service wallets.

[Guccho]

this is especially true for anything which I will connect to my personal wallet.

Connecting your personal wallet to these sites would still expose you to risks of social engineering on those wallets, it is better you have a separate wallet you can connect to these Dex platforms and only send funds from your personal wallet to the service wallet each time you want to effect a swap. Better if you use a cold storage for your personal wallet and send funds from there to your hot wallet which you can connect as you wish and is less risky since only very limited funds should exist on those service wallets.

Though it is out of OP's contexts, Actually I think the main risk here is in two places:

Smart contract exploit : When you connect a wallet you often automatically give the site or contract permission to spend a certain amount of tokens. If the contract has a bug or is malicious it can empty your entire balance without your knowledge.

Social engineering/phishing: There are countless fake sites that look like real DEXs but when you connect they actually ask for permission for unlimited approval . Many people don t notice and that s where the damage starts.

However, what I found out by doing Google and Reddit is that the best way to mitigate this risk is to create a separate workflow:

Hardware wallet: Keep large amounts of main funds here. It should never be connected directly to a website.

Hot wallet: Keep small amounts of funds only for trading or using the DEX. When the work is finished the profit or remaining money will be sent back to the cold wallet.

In other words this is a lot like everyday life where you leave gold and money in the safe at home and when you go out you only take some spending money in your pocket and go out. The same principle works in blockchain.

[Outhue]

That browser is likely chrome or Firefox browser, they are not safe for searching through google, you will end up with many bad links in google search, I liked what Brave browser and Microsoft edge have done, there is no room for fake links in the search engine, even if you use google search through them.

Still it is crucial to always be on guard when surfing the internet, first of all, you can't always be on  guard, meaning that anything can go wrong at any time, so for your digital asset sake try to buy a standalone crypto wallet for safe keeping and you can use your PC with peace of mind of not losing anything in return.

Some lessons will come at a cost but if the cost is very minimal it is still better, the wallets that should be on PC are the ones you use for airdrops and completing tasks online.

[Rustam Meraj]

This is very important warning about clever scam where criminals pay to put fake crypto websites at top of Google search results. Since fake sites are even hosted on trusted places like Google domain they trick people into thinking link is real. When you connect your wallet to one of these fake sites they can steal all your money. You must never trust sponsored ads for crypto links. So here I will say that best way to stay safe is to bookmark real websites always type address yourself and check URL twice before connecting your wallet.

[avp2306]

This is very important warning about clever scam where criminals pay to put fake crypto websites at top of Google search results. Since fake sites are even hosted on trusted places like Google domain they trick people into thinking link is real. When you connect your wallet to one of these fake sites they can steal all your money. You must never trust sponsored ads for crypto links. So here I will say that best way to stay safe is to bookmark real websites always type address yourself and check URL twice before connecting your wallet.

Seems this attack is called SEO poisoning and this confuse lots of newbies searching those famous sites. That's why I really don't like to search on google when I need something especially those site I'm using since I'm expecting this situation will happen since there are lots of phising site in google waiting for their victims to pick them.

If people out here find something like that in google they better report it so google support or working behind this area could take action to take down those fake sites.

Bookmarking the site you are using is really the best decision to do to avoid getting a serious issue with those fake sites.

[Akbarkoe]

As technology develops and as the growth of digitalization and the increasingly tight security, the more clever the fraudsters are looking for loopholes against ordinary people.

So this must be a note, howver you use the internet when you are tracing a link, then pay attention to the domain and especially read carefully, do not carelessly click anywhere, in any place, not only on Google or others I hope everyone can read, even if you are a lazy reading, your main security is your accuracy in any case.

The thief is getting smarter then you must be smarter than them.

[Awaklara]

As technology develops and as the growth of digitalization and the increasingly tight security, the more clever the fraudsters are looking for loopholes against ordinary people.

So this must be a note, howver you use the internet when you are tracing a link, then pay attention to the domain and especially read carefully, do not carelessly click anywhere, in any place, not only on Google or others I hope everyone can read, even if you are a lazy reading, your main security is your accuracy in any case.

The thief is getting smarter then you must be smarter than them.

Actually, the way scammers use phishing sites like that has been around for a long time. It's not something new to us. Avoid all forms of advertisement sites that appear in search results that we find. 
We know that the targets of scammers are those who are not well-informed, as well as people in a hurry so that they don't pay attention to what they click. 
In the past, phishing sites for CoinMarketCap were also found, where when you visited them, you would be immediately asked to connect your wallet to the site. 
This is not a new method, but the awareness and knowledge about it must still be acknowledged.

[SquirrelJulietGarden]

Actually, the way scammers use phishing sites like that has been around for a long time. It's not something new to us. Avoid all forms of advertisement sites that appear in search results that we find. 
We know that the targets of scammers are those who are not well-informed, as well as people in a hurry so that they don't pay attention to what they click. 
In the past, phishing sites for CoinMarketCap were also found, where when you visited them, you would be immediately asked to connect your wallet to the site. 
This is not a new method, but the awareness and knowledge about it must still be acknowledged.

Phishing scam is not a new scam type and phishing sites appear on Google search results, on top, is not new too. This scam method is old and Google have given scammers chances of showing their phishing sites on top results of Google. Let's ask Google why they do this as an unofficial support to scammers.

Learning about scam includes phishing scams is good as prevention is better than cure. Knowing more about scam methods can help you avoiding scam traps better.
Cryptocurerrency scam book.
[LEARN & EARN] Phishing Quizzes - Beginners & Experts.

[DYING_S0UL]

Rule number one, always avoid the first search result, specially if it says "sponsored".

As everyone already said, this kind of phishing method has been here for years and google doesn't do anything to prevent them, despite knowing scammers has been using this to channel their phishing sites! All of us  are aware and I try my best to avoid clicking random links. As for entirely making them disappear, I mostly use a ad blocker and it gets the job done, I don't see those ads...

Btw, does anyone know whether this can be avoided by changing the search engine?

[boyptc]

This is very important warning about clever scam where criminals pay to put fake crypto websites at top of Google search results. Since fake sites are even hosted on trusted places like Google domain they trick people into thinking link is real. When you connect your wallet to one of these fake sites they can steal all your money. You must never trust sponsored ads for crypto links.

And people who doesn't know much about these phishing links will trust it because they'd see google in it. That's how they put trust on a website even to the point that it's domain being used for scamming.

So here I will say that best way to stay safe is to bookmark real websites always type address yourself and check URL twice before connecting your wallet.

That is one way of determining the genuine and fake ones.

It's also best to not put any single attention to it when you don't know what you are visiting. And also, links that are sent through messages, don't click those links if they're from messaging apps and from a random guy.

[tvplus006]

...Don't rely on google for real links, it can be misleading sometimes.

Given the fact that such advertising on Google is not moderated manually, but based on algorithms, attackers use this to post phishing links. Metamask has proven itself very well, which blocks its content when going to a phishing site.