Phishing & Scam Awareness

Look-alike Domains

A practical approach to look-alike domains

Understanding “Look-alike Domains” starts with the real task described on this Phishing & Scam Awareness page. The relevant concepts include phishing sites, fake support, fake airdrops, lookalike domains, malicious signatures and social engineering. The goal is to separate interface hints from identifiers and states that can be independently checked through the active network, a block explorer, or the wallet itself.

Before confirmation, read or record the non-sensitive details that matter: domain spelling, entry source, recovery-material requests, contract address, signature content and urgency tactics. This creates a reliable troubleshooting trail if a transaction is pending or an interface displays an error, without resorting to repeated signatures, repeated submissions or disclosure of recovery material.

The main risk boundary includes brand impersonation, search-ad redirection, remote control, clipboard replacement and deceptive approvals. Knowledge from imtoken can explain how to inspect a request, but it cannot guarantee a third-party DApp, smart contract, bridge or service. Users should make a separate judgment about the specific counterparty and should never provide recovery material.

Fake Airdrops

A practical approach to fake airdrops

For “Fake Airdrops,” the useful skill is not memorizing where a button appears. It is knowing the order of decisions around phishing sites, fake support, fake airdrops, lookalike domains, malicious signatures and social engineering: identify the object, confirm the network and account context, understand the requested change, and decide what evidence will show that the action completed as intended.

Decide whether to continue only after checking domain spelling, entry source, recovery-material requests, contract address, signature content and urgency tactics. When a wallet, DApp, exchange interface and explorer appear to disagree, first resolve the network and on-chain object instead of assuming that every interface is referencing the same chain or asset.

Typical risks include brand impersonation, search-ad redirection, remote control, clipboard replacement and deceptive approvals. No “absolute safety” claim can remove these possibilities. A more realistic approach is to minimize secret exposure, keep approvals scoped to the intended use, verify the target and remove connections or permissions that are no longer needed.

• domain spelling
• entry source
• recovery-material requests
• contract address
• signature content
• urgency tactics

Malicious Signature Requests

A practical approach to malicious signature requests

“Malicious Signature Requests” is connected to the steps before and after it, so control, network context and on-chain outcome should be considered together. With phishing sites, fake support, fake airdrops, lookalike domains, malicious signatures and social engineering in view, a user can distinguish a read-only request from a connection, signature, approval or transaction instead of treating every wallet prompt as equivalent.

A practical review can consistently cover domain spelling, entry source, recovery-material requests, contract address, signature content and urgency tactics. If one of these does not match the intended action, stop and re-check the source and destination before submitting again. Seed phrases, private keys and verification codes are never normal troubleshooting fields and should not be shared.

Include brand impersonation, search-ad redirection, remote control, clipboard replacement and deceptive approvals in routine maintenance instead of waiting for an incident. Review old approvals, keep the device environment trustworthy, verify domains and networks, and retain the public transaction information needed to independently check what happened.

Remote-control Risks

A practical approach to remote-control risks

Names and icons can look familiar in a “Remote-control Risks” workflow without referring to the same on-chain object. For phishing sites, fake support, fake airdrops, lookalike domains, malicious signatures and social engineering, verifiable identifiers are more dependable than visual similarity, particularly when several EVM-compatible networks or similarly named assets are involved.

An actionable checklist should include domain spelling, entry source, recovery-material requests, contract address, signature content and urgency tactics. Review intent before the prompt, read the prompt during confirmation, and verify the outcome afterwards with a transaction hash, public address, contract address or network state when applicable. These three checkpoints are more useful than a generic warning.

Problems in this area often come from brand impersonation, search-ad redirection, remote control, clipboard replacement and deceptive approvals. If the source is suspicious, the target is unclear or the request exceeds the task at hand, decline it and investigate. On-chain transactions generally cannot be unilaterally reversed by a wallet, so verification is more important than speed.

• domain spelling
• entry source
• recovery-material requests
• contract address
• signature content
• urgency tactics

When Something Looks Wrong

A practical approach to when something looks wrong

Finishing “When Something Looks Wrong” should not mean stopping at a success message. Use phishing sites, fake support, fake airdrops, lookalike domains, malicious signatures and social engineering to check the conditions before submission, the request at confirmation time and the resulting state afterwards. That makes the workflow repeatable and easier to troubleshoot.

For a first attempt, rehearse the workflow using non-sensitive, verifiable information such as domain spelling, entry source, recovery-material requests, contract address, signature content and urgency tactics. Understanding what each field represents before an irreversible action or permission change is safer than mechanically copying a sequence of clicks.

Finally, distinguish “submitted” from “confirmed.” brand impersonation, search-ad redirection, remote control, clipboard replacement and deceptive approvals can affect the actual outcome or permission exposure. Use the relevant network record, explicit approval state and destination-service support information rather than unverified assurances as evidence.