Four checks before you connect

Reach the site from a bookmark rather than a search ad or a DM link. Compare the domain character by character. Read what the wallet pop-up says you are signing — a transfer and a login look nothing alike. And keep a separate wallet holding only what this session needs, so a bad signature cannot reach the rest.