Look at the domain character by character. Attackers register lookalike domains with swapped letters or extra words that are easy to miss.
A padlock in the browser is a minimum requirement, but it does not prove legitimacy. Scammers can get certificates too.
Type the official address yourself or use a bookmark. Do not trust links in emails, ads or social media posts.
Poor spelling, urgency, requests for your seed phrase, or prices that are too good to be true are all red flags.
Check the project's official social accounts and community for reports of a fake site. Legitimate projects usually warn users about impersonators.
When in doubt, do not connect your wallet. Verifying a site takes seconds; losing your funds is permanent.