A Pre-Login Routine for Confirming You Are on the Real Exchange Domain

Most credential theft does not start with a broken page. It starts with a link you did not verify: a message, an ad, a search result, a post in a group chat. The page that opens can look convincing enough that you type your email and password out of habit. The fix is not a better memory for domain names, it is a fixed routine that runs before your hands reach the keyboard. This guide sets out a short pre-login check you can apply to any exchange you hold an account with, whether that is Binance, OKX, Bybit or Bitget. It covers how to arrive at the login page by your own route, what to look at in the address bar and the certificate panel, how to handle password managers and bookmarks, and what to write down when a page fails the check. Nothing here replaces the security pages in each platform's own help centre, which is where you should confirm the details that matter for your account.

Start from a route you control, not a link you were sent

The single most effective habit is to stop opening exchange links that arrive from anywhere else. Treat every link in an email, a direct message, a comment, a search advertisement or a community post as unverified, even when the sender is someone you know and even when the message looks like a routine security notice. If the message claims there is a problem with your account, that is exactly the situation in which people click fastest, so slow down instead.

Open a new browser tab and reach the login page through a route you established earlier: a bookmark you created yourself, a typed address you have verified before, or the official app you already have installed. If you are not sure of the correct address, go to the platform's help centre first and navigate from there, rather than trusting the first search result. Search results, including paid placements, are a common delivery route for lookalike pages.

Once you are on a page you believe is genuine, do not log in immediately. Confirm the address first, then log in. Doing the check before typing means a failed check costs you nothing.

Read the address bar properly, not just the logo

Look at the whole address, not the part that resembles the brand. Attackers rely on long strings where the real registered name sits far to the right or is buried after a subdomain. Read the address from the right-hand side back toward the left, and identify the registered name of the site. If the brand word appears only as a prefix or somewhere in the middle of a longer string, that is a stop condition.

Check the connection indicator as well. A padlock or similar marker tells you the connection is encrypted, not that the site is the one you think it is. Anyone can obtain a certificate, so encryption and identity are separate questions. The address itself is the primary evidence.

Be alert to small substitutions that survive a quick glance: an extra word, a hyphen in an unexpected place, a doubled letter, a different ending, or a character that resembles a Latin letter but is not one. If you have to study the address for several seconds to decide, treat that as a fail and start again from your own route.

Use the certificate panel and your password manager as second checks

If the address passes your first read, open the certificate details from the connection indicator in your browser and look at which organisation the certificate was issued to and which names it covers. This is a supporting check, not proof on its own, but a certificate issued to an unrelated organisation for a page that presents itself as an exchange is a clear reason to stop. Note what you saw so you can compare it next time.

Your password manager is a useful independent signal. If it has an entry saved for the genuine site, it will normally offer to fill only on a matching address, and it will stay silent or warn you on a lookalike. Treat that silence as information. If you use a manager, let it fill the credentials rather than typing them yourself, and never paste credentials into a page that the manager did not recognise.

If you have two-factor authentication enabled, remember that it protects the login step, not the decision to type your password into the wrong page. A one-time code entered on a fake page can be captured and used immediately. The address check has to happen before any credential or code is entered.

What to do when a page fails the check, and what to record

If anything about the address, the certificate or the password manager's behaviour does not fit, close the tab. Do not log in, do not enter a one-time code, and do not try to reach the site by editing the suspicious address. Reopen your own bookmark or the installed app and continue there. If the message that brought you to the page claimed an urgent account problem, verify it from inside your account or through the platform's help centre, never through the link that started it.

Then write it down. Record the date and time, the exact address you saw, how the link reached you, which platform it pretended to be, and whether you entered anything before you stopped. If you did enter credentials, change your password from a route you trust and review your active sessions and any connected devices or applications from your account settings. If you did not enter anything, you still have useful information for the platform.

Report the page through the platform's official support channel, using the help centre to find the correct reporting route. Keep your own log of these attempts over time. Patterns in the log, such as the same sender or the same lookalike wording, tell you where to tighten your habits, and give you a factual record if the same attempt appears again.

Risk boundary: Exchange Cost Lab

Digital assets are volatile and derivatives can amplify losses. This website has no login, wallet connection, deposit form or customer-support chat. A referral link only records attribution; it does not guarantee access, pricing, rewards, approval or investment results. Availability can differ by residence, legal entity and product, so no regional access is assumed from language or branding alone.

Scenario checkpoint

• Before typing anything, confirm you arrived at the login page through your own bookmark, a previously verified address, or the installed app, not through a link from a message or search result.
• Read the full address from right to left and identify the registered name; if the brand word appears only as a prefix or inside a longer string, stop and start again from your own route.
• Open the certificate details and note which organisation the certificate was issued to; an unrelated issuer on a page presenting itself as an exchange is a stop condition.
• Let your password manager fill the credentials; if it does not recognise the address, do not type the password or a one-time code by hand.
• If the page fails the check, close the tab without logging in and report the address through the platform's official support channel.
• If you did enter credentials, change your password from a trusted route and review active sessions and connected devices in your account settings.