什么是钓鱼网站？What is a phishing site?

钓鱼（Phishing）＝伪装成官方或可信一方，骗你输入助记词、或诱你签下危险的授权与签名。钓鱼站往往和真官网几乎一样：一样的logo、一样的排版，只有网址有细微差别，比如把字母o换成数字0、多一个连字符、换个后缀域名。人在着急领空投、抢额度时最容易看走眼。Phishing = pretending to be an official or trusted party to trick you into entering your seed phrase, or to lure you into signing dangerous approvals and signatures. A phishing site is usually almost identical to the real one: same logo, same layout, with only a tiny difference in the URL — for example replacing the letter o with the digit 0, adding an extra hyphen, or swapping the domain suffix. People miss it most easily when rushing to claim an airdrop or grab a limited spot.

常见套路有这些：Common tricks include:

• 假空投、假活动页：「点击领取」其实是让你签授权Fake airdrops and event pages: "click to claim" actually makes you sign an approval
• 假客服、假官方私信：说你钱包异常，要「核对助记词」帮你处理Fake support and fake official DMs: they say your wallet has a problem and want to "verify your seed phrase" to help you
• 仿冒官网的搜索广告位，排在真官网前面Fake search ads impersonating the official site, ranked ahead of the real one
• 群里、评论区置顶的「福利链接」"Bonus links" pinned in chat groups or comment sections
• 假「找回被盗资产」服务，反而骗走你剩下的钱Fake "recover your stolen assets" services that instead steal whatever you have left

防护的核心就几条，且都不难：The core defenses are just a few, and none are hard:

• 助记词/私钥绝不在任何网站输入，官方永远不会要——这条能挡住一大半骗局Never enter your seed phrase or private key on any website — official teams will never ask; this one rule blocks more than half of all scams
• 只从收藏的官方书签进入DApp，逐字核对网址，别从广告位和私信点进去Only enter a DApp from your bookmarked official link, check the URL character by character, and don't click in from ads or DMs
• 签名、授权前看清内容，看不懂就不签，警惕盲签Before signing or approving, read the content clearly; if you don't understand it, don't sign — beware of blind signing
• 对「限时」「马上没了」的催促保持冷静，越催越要停Stay calm about "limited time" or "almost gone" pressure — the more it rushes you, the more you should stop

记住钓鱼的本质：它不「黑」你的钱包，它骗你自己打开门。技术再好也防不住一次慌乱中的确认，所以最可靠的防线是习惯——网址核对、拒交钥匙、慢一点、不盲签。真怀疑时，宁可关掉页面、从官方渠道重新确认，也别赌那一下。Remember the essence of phishing: it doesn't "hack" your wallet — it tricks you into opening the door yourself. No amount of technical skill can protect you from a single panicked confirmation, so the most reliable defense is habit: check the URL, refuse to hand over your keys, slow down, and don't blind-sign. When in real doubt, it's better to close the page and re-confirm through official channels than to gamble on that one click.