Sort:  

Do you know if the website is phishing the key in a passive manner or only if someone use the keys on their website?

As far as I understand you click the website. And then click a link for the contest and they bring you to a different URL with a fake hive signer page. I checked other ones and the hivesigner page looks convincing except the URL.

And they log everything you submit on the fake hive signer page.

I didn't check this one but I'd be highly surprised if it's different.

They would likely have a slightly different experience for steem and blurt