- Fires when
- Something about the interface feels off and you cannot articulate why.
- First move
- Check the middle of the address, then the signature. Before typing.
- What it usually is
- Your security level blocking something, a stylesheet that failed under congestion, or a genuine interface change.
- What it occasionally is
- A copied page, which is the case the check exists for.
- The mistake
- Dismissing the feeling because you cannot name the difference.
Trust the instinctA vague feeling that something is off is the cheapest signal you will ever get here. Checking costs a minute. Talking yourself past it is how people ignore the only warning they received.
Changes that are innocent
| What you see | Usually |
|---|---|
| Layout shifted, fonts different | Your security level is blocking something it did not before, or a stylesheet failed to load |
| Pieces missing, half rendered | Partial fetch under load. Reload once. |
| Slower and plainer | Degraded mode during heavy traffic, which is deliberate |
| A genuinely new interface | Platforms do change. It appears on all three addresses and asks you for nothing new. |
Changes that are not
- A login prompt when you were already logged in, particularly during an outage.
- A request for a wallet phrase in any framing. There is no legitimate version of this.
- Being asked to confirm your account to continue, which is not a thing that happens.
- A prompt to lower your browser security to make something work.
- Any deadline at all. Nothing here operates on a clock.
The check that settles it
Whether the other addresses look the same. A real interface change appears on all three, because they reach the same platform. A copy is one address. That comparison takes a minute and answers the question more directly than staring at the page you are already on.