Six common ways domains get faked
The eye auto-corrects when reading a domain, which is exactly what copycats exploit: it looks right but one character is off. Turning the known distortions into a checklist and ruling them out one by one beats judging by impression.
What to prepare before you start
These five things cover almost every delay people run into: Copy the official domain in full onto paper or into a note as your reference.
Open the page in question and copy the address-bar domain out in full. Compare character by character; do not just read the first part.
On mobile the address bar may be truncated, so tap to expand it.
Rule out the six patterns one by one
Check the address bar against this list: Letter swaps: o for 0, l for 1 and other look-alike substitutions.
Extra characters: an added letter or hyphen inside the brand word. Suffix changes: .com swapped for .net, .cc, .io and so on.
Prepended or appended words: -login, -official, cn and similar around the brand. Subdomain disguise: the brand appears first while the real registrable domain is something else.
Non-Latin characters: look-alikes from other scripts impersonating Latin letters.
Fees, limits and processing times
Numbers change from time to time, always confirm on the official fee page before you commit size: Official entry: use okx.com or your own bookmark, and check the domain letter by letter - look-alike domains are the most common phishing trick here.
Install the app from App Store, Google Play or the official OKX download page; Android users should avoid APK files shared through chat groups. Set a separate fund password alongside Google Authenticator, then enable the anti-phishing code and address whitelisting.
Review login devices regularly and expect extra checks after changing SIM, email or device. The help centre and in-app support cover most issues; for fund-related cases open a ticket and keep the reference number.
Nobody from real support will ask for your password, 2FA code or seed phrase - treat anyone who does as a scammer.
The OKX-specific part
OKX uses only its own primary domain, while copycats often append words like -login to it. Campaign links appear in on-site announcements or verified social accounts; never trust links in outside group chats.
Frequently asked questions
If the domain matches, am I safe
A correct domain is necessary but you still check the certificate; both must match before typing a password.
Is it fine to click short links
Better not. Shorteners hide the real address so you cannot verify before clicking.
I cannot see the whole domain on my phone.
What now
Tap the address bar to expand it, or long-press the link and copy it into a note.
Risk notes and next steps
Keep reading:代币化股票的对手方风险;杠杆仓位与强制平仓;美股行情总览. Read domains right to left: the registrable domain first, then the prefix.
Close a suspicious page rather than "just having a look". Store the official domain as plain text so you cannot mistap a look-alike link.
