Torzon, read the screenA collection of the things you actually see, explained

The collection

Screens

Screens

Six specimens, and what they have in common is that every one of them is designed to be believed. A screen is the cheapest thing to copy in this entire subject, which is why none of them can be used as evidence of anything.

What is in this room

Why a screen proves nothing

A page is a file. Copying one takes a right click and a save, and the copy renders identically because it is the same file. There is no visual property, no layout detail and no logo that survives that process as a distinguishing mark, and there never will be.

So the correct order is settled before you look at anything. Address first, signature second, screen last. If you find yourself judging a page by how right it looks, you have skipped the two steps that could actually answer the question.

What the screens can tell you

Something useful, just not about authenticity. They tell you what state you are in. A queue means wait, a captcha loop usually means your circuit rather than your typing, a rate limit looks identical to a rejection, and knowing which of those you are in saves people from the thing that turns a small problem into a lost account.

The order that makes this room harmless

Address first, signature second, screen last. In that order the screens stop being evidence and become a report on what state you are in, which is what they are actually good for.

Start with the queue

What each screen is actually for

ScreenIts jobWhat people read into it
A queueAdmitting visitors at a rate the far end can serveThat something is wrong
A login formCollecting credentialsThat the site looks right, therefore is right
A captchaMaking automated traffic expensiveThat they are typing it wrong
A maintenance noticeExplaining an outage, sometimesThat the instructions on it came from the market
A gateway pageFetching an onion for a normal browserThat it is a convenient shortcut with no cost
A support messageGetting a credential out of youThat somebody helpful noticed their problem

The right hand column is where the losses live. Every one of those readings is reasonable, and every one is about the wrong thing.

The order that makes screens harmless

Address first, signature second, screen last. Done in that order the screens stop being evidence and become what they are, which is a report on what state you are in. Done in the other order you are trying to judge authenticity from a file that copies perfectly, and no amount of care rescues that.

It is worth saying plainly because the natural order is the reverse. The screen is right in front of you and the address is behind you, so the eye starts with the thing that cannot answer.

The state you are most likely in

Waiting for something on the other side, which covers the queue, the slow captcha and most of the maintenance notices. The correct action in all three is nothing, and the wrong action in all three is going to look for another way in. That is when a helpful address or a helpful stranger appears, and the timing is not a coincidence.