Verified links
Check a site's certificate and address in one minute before logging in
Before you type a password, check two things: the domain in the address bar must match letter for letter, and the site certificate must be issued for that domain. A padlock only means the connection is encrypted. It does not prove the site is genuine, because a fake site can get a free certificate within minutes.
Verified on · Guide by the SlotKaki team
Spelling the domain out, letter by letter
The domain is the part of the address after https:// and before the first single slash /. The part that identifies the owner is the last two pieces before that slash, for example slotkaki.shop or slotkaki.org. Compare it with the official domain list.
| Trick | Typical pattern | How to catch it |
|---|---|---|
| Doubled or swapped letters | slotkakki.example | Read slowly, one letter at a time |
| Lookalike characters | rn for m, 1 or I for l, 0 for o | Zoom in, or paste the address into a note |
| Added words | slotkaki-bonus-xx.example | The real domains contain no hyphen |
| Letters from another alphabet | An address shown starting with xn-- | Treat it as a warning and leave |
A password manager is a useful second check. It offers to autofill only on the exact domain it saved. If it suddenly stops offering your password, stop and look at the address.
What the padlock and certificate details tell you
A site certificate (a TLS certificate) is a file that lets the browser encrypt the connection to the server for a particular domain. Basic certificates are issued automatically to anyone who controls a domain, scammers included, which is why most copycat sites now show a padlock as well.
| What you see | What it means |
|---|---|
| A padlock or settings-style icon beside the address | The connection is encrypted. It says nothing about who runs the site. |
"Not secure", or an address starting http:// | No encryption. Do not type a password. |
| A red warning page such as "Your connection is not private" | The certificate is invalid or belongs to another domain. Close the tab and do not choose to proceed. |
Recent versions of Chrome replaced the padlock with a settings-style icon; it does the same job. To view the certificate on a computer, click the icon beside the address, open the connection details, then the certificate. Confirm that "Issued to" or the subject alternative names list the domain you meant, and that the validity dates have not passed. Many mobile browsers hide the full details, so on a phone the spelling of the domain is your main check.
Subdomains built to mislead
Read a domain from right to left. In slotkaki.shop.example.com the real owner is example.com. The words slotkaki.shop in front are just a label the owner of example.com chose, much like a folder name.
slotkaki.org.verify-xx.example: the real domain isverify-xx.example.https://slotkaki.shop@login-xx.example/: the browser ignores everything before the@, so you are really heading tologin-xx.example.https://xx.example/slotkaki.shop/login: the brand name sits in the path after the slash, not in the domain.
This portal itself lives at slotkaki-online.pages.dev, a subdomain of a hosting service anyone can use. That is why the full name has to match exactly. Similar-looking names on pages.dev are not us, and this portal never asks you to log in.
Short links and QR codes
Short links and QR codes both hide the real address until you open them. They have honest uses, but they are also an easy way to send people to a copycat.
- Short links: do not use them to log in. If you must open one, check the address bar once the page loads, not the link text.
- QR codes: the camera app usually shows the address before opening it. Read it first and back out if the domain does not match.
- QR codes on posters or in messages: a new sticker can be pasted over the original. A QR code promising a bonus over chat should be treated as fake.
- After it opens: always check the domain again before typing anything.
A one-minute check before entering a password
- You arrived from an address you typed or a bookmark, not from a message link or an ad.
- The domain is exactly
slotkaki.shoporslotkaki.org, read from right to left. - The address starts with
https://and there is no certificate warning. - Your password manager offers to autofill as usual.
- The page is not asking for a bank OTP or an APK download.
How the genuine login process works is explained in how SlotKaki login works. Other signs of a copycat are listed in how to spot a fake SlotKaki site.
Frequently asked questions
If there is a padlock, is the site safe?
Not necessarily. A padlock only means the connection between your browser and the server is encrypted. Fake sites can get free certificates for their own domains too. What tells you a site is genuine is the exact spelling of the domain.
What is the difference between a domain and a subdomain?
A domain is the registered name, such as slotkaki.shop. A subdomain is a label in front of it that the domain's owner creates. In slotkaki.shop.example.com the owner is example.com, not slotkaki.shop, which is why a domain should be read from right to left.
What should I do if the browser shows a certificate warning?
Close the tab and do not choose the advanced option to continue. The warning means the certificate is invalid, expired or issued for a different domain. Reopen the address by typing it yourself, and if the warning persists, report it to official support.
Before you log in Type slotkaki.shop yourself, read the domain from right to left, and type your password only when every letter matches.
Open slotkaki.shopCheck other domains