The Anatomy of a Phishing Site
1. The URL is Everything (Typo-squatting)
steamcommmunity.com(Three 'm's)stearncommunity.com('r' and 'n' look like an 'm')steam-community.com(Added hyphen)skinport-market.com(Added words to a real brand)csfloat.io(Wrong top-level domain; the real site is .com)
- Never click links sent by strangers. Whether in Steam chat, Discord, or blog comments, treat unsolicited links as hostile.
- Read the URL character by character. Before entering credentials anywhere, stop and read the address bar carefully.
- Use Bookmarks. The safest way to navigate to marketplaces or gambling sites you use frequently is to bookmark them yourself.
2. The "Fake Popup" Test (The Drag Test)
- If it's REAL: The window will move freely outside the main browser frame, because it is a separate, independent window governed by your OS.
- If it's FAKE: The window will get "stuck" at the edge of the main browser window and disappear if you drag it too far. It cannot leave the webpage it was drawn on.
3. Don't Trust the Padlock (SSL Certificates)
4. The "Already Logged In" Check
Summary Checklist for Safe Logins
- Did I navigate to this site via a trusted bookmark or a Google search, or did I click a link sent to me? (If a link was sent, be extremely suspicious).
- Have I read the URL carefully to ensure it is spelled perfectly?
- Can I drag the login popup outside the main browser window?
- If I'm already logged into Steam in this browser, is it forcing me to type my password again?
