How to Verify Official Links and Avoid Phishing

BeginnerOct 28, 2026 · 6 min read

Before you connect a wallet or sign anything, confirm you are on an official entry path — not a lookalike site, search ad, or “support” message wearing a familiar brand. Success: you open the venue from a bookmark or address you already verified, you can read the real domain in the bar, and you close anything that asks for a seed, remote control, or a rushed send.

Goal

Before you connect a wallet or sign anything, confirm you are on an official entry path — not a lookalike site, search ad, or “support” message wearing a familiar brand.

Success: you open the venue from a bookmark or address you already verified, you can read the real domain in the bar, and you close anything that asks for a seed, remote control, or a rushed send. This page owns the entry checks. Seed backup steps live in How to Protect and Back Up a Seed Phrase. Session checklists live in Security Checklist for New DEX Traders. Approval mechanics live in What Is Token Approval?

Before You Start

What you need

The project or venue you intend to use (DEX, wallet app store page, docs hub).
A browser or phone where you can create bookmarks.
Willingness to spend one careful first visit before any connect.
Your wallet ready to read prompts — not to paste secrets into websites.

Why this check exists

On wallet-first rails the website is often only a frontend. A fake frontend can still show a familiar layout, logo, and market list, then ask your wallet for a signature or approval that moves funds. Interface is not the protocol — so entry hygiene is part of trading, not an optional extra. There is usually no “undo desk” after you Confirm a hostile ask.

Risks you accept if you skip this

A single bad connect/approve on a cloned site can drain allowances or trick a transfer.
Urgency (“verify in 10 minutes,” “claim before expiry”) is a common pressure tactic, not a trading requirement.
HTTPS / a padlock does not prove identity; most phishing sites use encryption too.

Steps

1. Establish the official source once — then bookmark it

On first use, find the domain or app from a channel you already trust for that project: the project’s own published site, documentation hub, or an official store listing you opened from that site.

Work outward from that verified page when you need social or support links. Do not search social first and trust whatever “verified-looking” account appears. Do not trust a link unfurled in chat just because the preview shows a familiar name — previews can lie about where the click goes.

When the domain is correct, bookmark it (or type it yourself next time). After that, open the venue from the bookmark — not by re-searching the brand name every session. Re-search is how ads and lookalikes win.

For wallet apps and extensions, install only from the project’s documented official path (official site → store listing, or the vendor’s documented download). Fake extensions and fake APKs use the same logos.

For wallet-first venues such as edgeX, use the domain the project publishes as official. Do not invent or guess the URL.

2. Read the domain before you connect

In the address bar, identify the registered domain (read right to left: the part that actually owns the site). A famous name in a subdomain, path, or query string can be costume — for example, a path that merely contains the brand while the real owner is elsewhere.

Watch for lookalikes:

swapped or missing letters
extra hyphens
wrong top-level domain (`.net` / `.io` instead of the real one)
digit `1` for letter `l`, or `0` for `O`
characters that only look like Latin letters

HTTPS / the padlock means the connection is encrypted — not that the site is genuine. Treat the padlock as a minimum for privacy on the wire, never as a brand badge.

If the name is only “almost” right, stop. Almost-right is the product.

3. Treat search ads, DMs, and forwarded links as untrusted by default

Sponsored results above organic search, links in chat, email, and social posts are common delivery paths for clones — including ads that outrank the real site and emails that forge a support tone.

Default action when you arrive from any of those paths: ignore the clicked destination. Open your bookmark or type the address you already verified in a fresh tab. Do not “just connect once to see.” Do not paste a seed to “finish verification” from an inbound message.

If a friend forwards a claim link, verify the destination yourself from your bookmark path. Friendship does not authenticate a domain.

4. Refuse fake support scripts

Real support for wallets and venues does not start by cold-DMing you after you post a help question in public chat.

Close and leave if someone:

claims to be support in an unofficial DM
asks for seed, private key, or backup words
asks you to install remote-access software or share screen control
moves you off the project’s designated help channels into a private “ticket room”
demands you send a small amount “to unlock” or “to sync”

No legitimate desk needs your seed to restore access, whitelist a wallet, clear a stuck deposit, or process a refund. If you need backup help, use How to Protect and Back Up a Seed Phrase — offline, inside your wallet — never in a stranger’s form.

5. Spot urgency and claim traps that lead to fake entries

Giveaways that require you to send funds first to receive more are scams.

“Claim” / airdrop pages that appear unsolicited often exist only to push a connect or approve on a hostile site. Countdown timers, “final warning,” and “account suspended — verify now” copy are there to skip your brain’s domain check.

You do not need those pages to trade on a venue you already bookmarked. If a claim flow demands a seed, it is already over — close it. If it only demands Connect / Approve, that is still an entry decision: return via bookmark and decide on the real site, or skip the claim entirely.

6. Last look: bar + wallet preview + certificate warnings

Immediately before Connect or Approve:

Re-read the domain in the bar (Step 2). Domains can change after a redirect.
Read the wallet preview: network, asset, spender/contract, amount, and action type. Connect is not Approve; Approve is not a trade. An unlimited spend, a transfer you did not intend, or a Sign-message you cannot explain in one plain sentence is a stop. Approval mechanics: What Is Token Approval?
If the wallet or browser shows a deceptive site / phishing warning, treat it as a hard stop — not a nuisance banner to click through.
If the browser shows an unexpected certificate warning on a site you thought you knew, stop. Do not click through. Close the tab and return via bookmark later.

Only then Confirm. If anything in this last look fails, reject and leave.

Check Before You Confirm

[ ] Opened from bookmark or typed verified address — not from an ad, DM, email, or forwarded claim
[ ] Registered domain matches what you established in Step 1
[ ] Padlock was not treated as proof of identity
[ ] No seed / key / remote-access request on the page or in chat
[ ] Wallet preview matches the action you intend (network, asset, amount, spender)
[ ] No phishing / deceptive-site / certificate warning overridden

If Something Looks Wrong

What you see	What to do
Domain is “almost” right	Close tab. Use bookmark / typed official address only.
Padlock present but you still doubt the name	Padlock is not identity. Re-verify domain or leave.
Support DM after you asked for help in public chat	Do not continue in DM. Use only designated official channels found from the verified site outward.
Page asks for seed or backup words	Close immediately. Do not type. Use the seed backup guide only inside your wallet app — never in a web form.
Remote-access / screen-share “support” ask	Refuse. End the session. Real desks do not need device control to help.
Wallet or browser phishing / deceptive-site warning	Disconnect and close. Do not override “to continue.”
You already connected or approved on a suspect site	Disconnect; treat allowances as risky; move funds to a fresh wallet if exposure is unclear; revoke bad approvals when you can (see What Is Token Approval?).
You typed a seed into a site or chat	Treat that seed as burned. New wallet + new offline backup; move what you still can; abandon the old seed.
Certificate warning on a “known” site	Stop. Do not proceed. Retry later from bookmark.
Unsolicited airdrop / claim / giveaway link	Ignore. Trade only through your verified entry.
You need the full session stop sheet	Use Security Checklist for New DEX Traders.

Ready for the next step?

Continue to registration or trading from this page using the official links.

Start trading on edgeX

Disclaimer

This content is for educational purposes only and does not constitute investment advice. Trading digital assets and derivatives involves risk. Make sure you understand the products and consider your own circumstances before trading.

Guides

How to Verify Official Links and Avoid Phishing

BeginnerOct 28, 2026 · 6 min read

Goal

Before you connect a wallet or sign anything, confirm you are on an official entry path — not a lookalike site, search ad, or “support” message wearing a familiar brand.

Before You Start

What you need

The project or venue you intend to use (DEX, wallet app store page, docs hub).
A browser or phone where you can create bookmarks.
Willingness to spend one careful first visit before any connect.
Your wallet ready to read prompts — not to paste secrets into websites.

Why this check exists

Risks you accept if you skip this

A single bad connect/approve on a cloned site can drain allowances or trick a transfer.
Urgency (“verify in 10 minutes,” “claim before expiry”) is a common pressure tactic, not a trading requirement.
HTTPS / a padlock does not prove identity; most phishing sites use encryption too.

Steps

1. Establish the official source once — then bookmark it

For wallet-first venues such as edgeX, use the domain the project publishes as official. Do not invent or guess the URL.

2. Read the domain before you connect

Watch for lookalikes:

swapped or missing letters
extra hyphens
wrong top-level domain (`.net` / `.io` instead of the real one)
digit `1` for letter `l`, or `0` for `O`
characters that only look like Latin letters

HTTPS / the padlock means the connection is encrypted — not that the site is genuine. Treat the padlock as a minimum for privacy on the wire, never as a brand badge.

If the name is only “almost” right, stop. Almost-right is the product.

3. Treat search ads, DMs, and forwarded links as untrusted by default

Sponsored results above organic search, links in chat, email, and social posts are common delivery paths for clones — including ads that outrank the real site and emails that forge a support tone.

If a friend forwards a claim link, verify the destination yourself from your bookmark path. Friendship does not authenticate a domain.

4. Refuse fake support scripts

Real support for wallets and venues does not start by cold-DMing you after you post a help question in public chat.

Close and leave if someone:

claims to be support in an unofficial DM
asks for seed, private key, or backup words
asks you to install remote-access software or share screen control
moves you off the project’s designated help channels into a private “ticket room”
demands you send a small amount “to unlock” or “to sync”

5. Spot urgency and claim traps that lead to fake entries

Giveaways that require you to send funds first to receive more are scams.

6. Last look: bar + wallet preview + certificate warnings

Immediately before Connect or Approve:

Re-read the domain in the bar (Step 2). Domains can change after a redirect.
Read the wallet preview: network, asset, spender/contract, amount, and action type. Connect is not Approve; Approve is not a trade. An unlimited spend, a transfer you did not intend, or a Sign-message you cannot explain in one plain sentence is a stop. Approval mechanics: What Is Token Approval?
If the wallet or browser shows a deceptive site / phishing warning, treat it as a hard stop — not a nuisance banner to click through.
If the browser shows an unexpected certificate warning on a site you thought you knew, stop. Do not click through. Close the tab and return via bookmark later.

Only then Confirm. If anything in this last look fails, reject and leave.

Check Before You Confirm

[ ] Opened from bookmark or typed verified address — not from an ad, DM, email, or forwarded claim
[ ] Registered domain matches what you established in Step 1
[ ] Padlock was not treated as proof of identity
[ ] No seed / key / remote-access request on the page or in chat
[ ] Wallet preview matches the action you intend (network, asset, amount, spender)
[ ] No phishing / deceptive-site / certificate warning overridden

If Something Looks Wrong

What you see	What to do
Domain is “almost” right	Close tab. Use bookmark / typed official address only.
Padlock present but you still doubt the name	Padlock is not identity. Re-verify domain or leave.
Support DM after you asked for help in public chat	Do not continue in DM. Use only designated official channels found from the verified site outward.
Page asks for seed or backup words	Close immediately. Do not type. Use the seed backup guide only inside your wallet app — never in a web form.
Remote-access / screen-share “support” ask	Refuse. End the session. Real desks do not need device control to help.
Wallet or browser phishing / deceptive-site warning	Disconnect and close. Do not override “to continue.”
You already connected or approved on a suspect site	Disconnect; treat allowances as risky; move funds to a fresh wallet if exposure is unclear; revoke bad approvals when you can (see What Is Token Approval?).
You typed a seed into a site or chat	Treat that seed as burned. New wallet + new offline backup; move what you still can; abandon the old seed.
Certificate warning on a “known” site	Stop. Do not proceed. Retry later from bookmark.
Unsolicited airdrop / claim / giveaway link	Ignore. Trade only through your verified entry.
You need the full session stop sheet	Use Security Checklist for New DEX Traders.

Ready for the next step?

Continue to registration or trading from this page using the official links.

Start trading on edgeX

How to Verify Official Links and Avoid Phishing

Goal

Before You Start

What you need

Why this check exists

Risks you accept if you skip this

Steps

1. Establish the official source once — then bookmark it

2. Read the domain before you connect

3. Treat search ads, DMs, and forwarded links as untrusted by default

4. Refuse fake support scripts

5. Spot urgency and claim traps that lead to fake entries

6. Last look: bar + wallet preview + certificate warnings

Check Before You Confirm

If Something Looks Wrong

Share

Related articles

Ready for the next step?

Disclaimer

How to Verify Official Links and Avoid Phishing

Goal

Before You Start

What you need

Why this check exists

Risks you accept if you skip this

Steps

1. Establish the official source once — then bookmark it

2. Read the domain before you connect

3. Treat search ads, DMs, and forwarded links as untrusted by default

4. Refuse fake support scripts

5. Spot urgency and claim traps that lead to fake entries

6. Last look: bar + wallet preview + certificate warnings

Check Before You Confirm

If Something Looks Wrong

Share

Related articles

Ready for the next step?

Disclaimer