Always check the URL. Never enter your SSO password on any other site.