A fake mirror is the most common way a buyer loses money on a Tor market, and it is also the most preventable, because the attack has a fixed shape and the defense has a fixed set of checks. Here is the anatomy of a clone, step by step, and the checks that stop it at each step.
Step one, the swapped address
A phisher registers an onion that differs from a genuine one by one or two characters, usually in the middle of the string, where the eye skips. The result is an address that looks right when you read it fast and is wrong in a way you only notice when you count. This is the whole attack in its simplest form. The phisher does not need to beat your security. They need to beat your reading. The defense is to copy the address from a source you trust rather than type it, and to match the last six characters in the address bar against what you copied once the page loads.
Step two, the copied page
Once you are on the swapped address, the phisher serves a copy of the login page, often captured from a screenshot of the real one. It looks identical, because it is a copy. You enter your passphrase and it goes to their server, not the market's. Some clones go further and replicate the deposit flow, so you fund a wallet and the address it gives you belongs to them. The page works. That is the trap. A working page is not a genuine page, and the only way to tell is the checks from step one, done before you type anything, not after.
Step three, the false announcement
The most sophisticated version rides a real rotation. When the operator announces a new mirror, a phisher watches the same announcement and pushes a copy of the new address into every chat group they run, changing one character. People who grab the address from the chat instead of the signed post land on the clone. The defense is to trust the signed post on the forum over any message in a channel, and to verify the signature before you use the new address. A screenshot in a chat is not a signature. A signed post is. That distinction is the difference between a rotation and a robbery, and it is the one habit that separates a buyer who has been through several market closures from one who is about to learn about their first.