BaitPath
中文 English

Official source checklist

Five items, roughly two minutes. Each says how to do it and what a failure looks like — the second half is the part that actually matters.

Tool cover: high-contrast geometric composition of a tick grid with blocking rectangles
Tool T-04 cover is a programmatic geometric composition.

No upload · No network · No storage — your ticks exist only in this page's memory and vanish on refresh. This page contains no code that makes a network request or writes to local storage.

The five checks

Run these against the page or app actually in front of you. If you cannot do one, mark it as not checked — do not mark it passed from memory.

1 · Domain read character by character

How: click the address bar so the full URL shows, then read right to left, checking only the last two segments — the top-level domain after the final dot and the one before it. Everything to the left of those is subdomain and can be set to anything.

2 · App store developer name

How: find the developer or provider field on the store listing and tap through to see what else they publish. Look at the developer name, not the app name or icon — those two are the easiest parts to copy.

3 · Where the support contact came from

How: confirm that the support conversation you are in was opened by you, from inside the official app or website, not handed to you, not found by searching, and not started by them.

4 · How you arrived this time

How: think back to how this page got opened. The promoted slot at the top of search results can be bought, has been a primary impersonation channel for years, and looks almost identical to organic results.

5 · Certificate subject

How: click the icon at the left of the address bar and look at what the certificate was issued to. Note that it only proves the certificate was issued for that domain — most certificates verify no company identity, so this is supporting evidence rather than the main test.

Nothing checked yet

Select any item above and a summary will appear here. You can screenshot it for comparison next time.

What the padlock icon actually proves

This is the single most common misreading

The padlock means traffic between you and that server is encrypted. It does not mean the company is real. Certificates asserting only control of a domain are freely available, and an imitation site obtains one as easily as anyone else — same padlock, same appearance.

Put plainly: if the far end is an impostor, encryption has only guaranteed that your password reached them undisturbed.

That is why the certificate check sits fifth rather than first. The decisive one is the first: reading the domain character by character. Full explanation in confirming a real app and a real site.

When it is worth running all five

Not on every visit. These four situations justify the two minutes.

Four moments worth checking

  • The first time you use a platform. Do it once, save the bookmark, and later visits cost nothing.
  • Before entering a password, a code, or submitting identity documents. None of those can be taken back.
  • After changing device or browser. With bookmarks not yet synced, people fall back to the search box.
  • Any time somebody hands you a link. Whoever they are, that link earns its own check — the reason is in six things a legitimate platform never does.

Related files

BaitPath desk · First published 2026-08-23 · Browsers differ in where certificate details live; go by the browser you are actually using.