Fake sites and poisoned links

Phishing sites don't need to hack anything — they just need a domain that looks close enough. cate-claim.meme instead of cate.meme. One swapped letter, one extra hyphen, and suddenly you're signing away your wallet on a page built to look identical to the real thing, right down to the logo.

Google ads get bought for fake versions of popular dapps. Fake "claim your airdrop" pages appear right after real airdrops, riding the hype while it's fresh. A helpful reply-guy drops a link under a project's tweet, and it goes to a clone, not the source.

The fix is boring and it works: bookmark the real sites yourself, once, from a source you trust, and use only that bookmark. Read URLs character by character before you connect anything. And if you land somewhere from a DM or a random reply, don't sign a thing — just close it.