It's as many comments has agreed on about the two users being correct in their respective explanations. There's are scammers with high tech devices that their pattern of phishing scam doesn't require the victim to input his informations into the fake app for his funds to be wiped out. Meanwhile there are phishing site that are programmed to steal your information to the scammer once you key it in. The safe culture to build is to always check URL authenticity and verify before using.
Yes, that's right. Both of these patterns often occur in phishing cases that result in the loss of assets. Some people lose their assets just by entering a fake site, while others lose their assets after entering a fake site and then logging in. But the point is, phishing cases in the crypto world are always present, so take this as a lesson to be careful when clicking any links. In fact, phishing has now developed to a different level, arguably sophisticated. This is no longer just "click a fake link and get hit," but you can open a genuine website and still get phished. We're usually taught "Check the URL don't make a domain typo." Nowadays, there are also cases where the URL is correct but the page has been injected, leading you to a phishing link, initially feeling safe when in fact you've already been phished.
This is how they usually work they disguise themselves as extension notes etc. When you open the target website it overlays a fake login page.
Your input credentials are immediately captured. It's very clean nothing unusual. So, it can be concluded that phishing isn't about whether the link is strange or not, but rather about your own compromised environment. Your browser appears normal even though it's been manipulated internally. So to avoid this it's best not to store assets in an online wallet. Even if you do avoid excessive internet connection.
