How to Spot a Fake Awazon Market Mirror

The most common attack on a Tor market visitor is not a server being compromised. It is a near identical onion address standing up a copy of the storefront to harvest passwords or to collect deposits sent to an address the attacker controls. Here is the anatomy of a fake mirror and the specific checks that beat it.

How a clone works

A phisher registers an onion that differs from a genuine one by one or two characters in the middle, where the eye is least likely to catch the swap. They copy the login page, often from a screenshot, and stand it up on their own server. When you type the address and it loads, it looks right. You enter your passphrase, and it goes to them. Or you fund a deposit, and the address it gives you belongs to them. The page works. That is the trap. A working page is not a genuine page.

The checks that beat it

Copy the address from a source you trust rather than typing it. One wrong character in fifty six is the whole attack, and copying removes it. Match the last six characters in the address bar against what you copied once the page loads. Verify the operator's PGP fingerprint against a copy you saved earlier, because a lookalike cannot sign with a key it does not hold. And treat any address that arrives in a chat, a Discord ping or a screenshot as suspect until you have checked it against a signed post. Convenience is rarely the priority in a security context. Accuracy is.

The fake support message

A second pattern is a private message from an account that looks like support, telling you to move your balance to a new address for maintenance, or to re enter your mnemonic to verify. The market does not ask for your mnemonic after registration, and it does not move balances to a new address on a message. If anything on the storefront breaks pattern, an unfamiliar format, a missing footer key, an unexpected request, close the tab, pull a fresh address from the mirror list, and try again from a clean circuit. The genuine storefront is patient. An attacker's is patient too, right up to the moment you submit the credential.