Six common ways domains get faked
The eye auto-corrects when reading a domain, which is exactly what copycats exploit: it looks right but one character is off. Turning the known distortions into a checklist and ruling them out one by one beats judging by impression.
What to prepare before you start
These five things cover almost every delay people run into: Copy the official domain in full onto paper or into a note as your reference.
Open the page in question and copy the address-bar domain out in full. Compare character by character; do not just read the first part.
On mobile the address bar may be truncated, so tap to expand it.
Rule out the six patterns one by one
Check the address bar against this list: Letter swaps: o for 0, l for 1 and other look-alike substitutions.
Extra characters: an added letter or hyphen inside the brand word. Suffix changes: .com swapped for .net, .cc, .io and so on.
Prepended or appended words: -login, -official, cn and similar around the brand. Subdomain disguise: the brand appears first while the real registrable domain is something else.
Non-Latin characters: look-alikes from other scripts impersonating Latin letters.
Fees, limits and processing times
Numbers change from time to time, always confirm on the official fee page before you commit size: Official entry: type binance.com yourself or use your own bookmark, then check the padlock and the exact spelling before typing any password.
App install: search the publisher name "Binance" on App Store / Google Play, or pull the APK from the official download page rather than a third-party store. Turn on Google Authenticator or a hardware key, then add withdrawal address whitelisting and an anti-phishing code to every email you receive.
Review the device list periodically, and use the global lock if you ever suspect a session is still active somewhere else. In-app chat is usually the fastest channel for account issues, and the help centre holds step-by-step articles for most problems.
For anything touching funds, open a ticket and keep the case number; never share passwords, codes or seed phrases with anyone claiming to be support.
The Binance-specific part
Binance has a single official primary domain; any variant with extra prefixes or suffixes should be treated as suspicious. Official messages never send login links by SMS or unexpected email; ignore anything that does.
Frequently asked questions
If the domain matches, am I safe
A correct domain is necessary but you still check the certificate; both must match before typing a password.
Is it fine to click short links
Better not. Shorteners hide the real address so you cannot verify before clicking.
I cannot see the whole domain on my phone.
What now
Tap the address bar to expand it, or long-press the link and copy it into a note.
Risk notes and next steps
Keep reading:代币化股票的对手方风险;杠杆仓位与强制平仓;美股行情总览. Read domains right to left: the registrable domain first, then the prefix.
Close a suspicious page rather than "just having a look". Store the official domain as plain text so you cannot mistap a look-alike link.
