Checking a mirror before you type anything
A fake mirror wins on trust, not on design. Three checks catch it before credentials go in.
awazonip66usn4oq6vn5b3fqjyjjvavzu3ototnjbmi2wg6bocfc7aqd.onionawazonwilo4vky6obkwrkv62vx24tnf5323pts6d7gohdoj4pjt646qd.onionawazonvewzuve3emyxtz2z7ko6bjv6m6qieioi2tuvbgwiomn6vyryyd.onionPaste, don't retype. One wrong character out of 56 opens someone else's site.
Check one: the last six characters
After the page loads, look at the address bar. Take the last six characters and compare them with the string you copied. One wrong character is a different address, not a typo. A v3 address is 56 characters long, and a single swapped letter still resolves to a valid site. Someone's site. It will have its own storefront, its own login form, its own little sense of occasion.
Copy the address once, paste it once, then verify. Do not retype it. Do not trust a bookmark you saved months ago. A mirror can be retired, and the address you saved quietly becomes a stranger's front door.
Check two: the PGP-signed list
The market publishes its mirror list as a PGP-signed message. The key is stable, the list rotates. The user id reads Awazon Market <[email protected]>, and the fingerprint of the primary key is 2B76 EB1A E895 09D4 0839 AD60 12C8 2C28 65D7 7D55. Run gpg --verify on the signed message. If the signature checks out, the addresses inside it are the ones the market claims at that moment. If it does not check out, none of them are, no matter how official the message looks.
The market public key
-----BEGIN PGP PUBLIC KEY BLOCK----- mQINBGe5BuABEACxN/dtAlDF2p6SK+cR9TN+XQIx1HJPAAAESIgbDRQdWWmcpphK bMVMDyCk2POoDy9n3RZ9UtCLDQRYcadDjz7EHLIKFYIzJK0ZUHw9PuuNGxTzvfKj FKvd4N6uGWn4V5aGYY8lzSFvlheWoLOjylhy3XIYoMiVh2bE6NdEvBkxGkvF2RVP ILQyqeqiyCdSXq/AsCBeOEZ8YI9zkwmlr/szb5nQLlZk1iFzGh7QHue9Bit+z8fo 25opCzoteeIaQ3vAA8+lorkZ8lEkVBE3O6MWrDUvD3dk5b8aB+hngP9y899TcZeD 0ve9IO7oT2egquTCxjcSnNtP8HRP+CK7j4PYZtk6t9Mitjc1J2MMAt4CxSl3e4So YqptEWQ9k70vx1ehlPzAjpJMNQYWOStEgouXsriqsN1G/ZVPf2JZlGfFqSuvhG2f y+fZSpE6S4t7+Vz9S0XjNwy9PTK0tMb/Vl5RmReDb3ZhsIDNVvC5k6GPRIi+4H2j 9CcHSbC0O1I39ak6DLG2/AZXKN7p4RQAJCHKrKdwyN66qxpz1FiQ2wPS5fbXOexr ZN1WA+ivNkzFrgZvIfpvm89GH2Vw8TPxokKUZfqrsjvFjtnIdehwdHwuG8D1WjKw 8eqQwSYO8nSlZoeFE2edMigj04ZWvdEUKYt5k2IsWtqCsUtHtpUtYlqgdQARAQAB tB1Bd2F6b24gTWFya2V0IDxmdWNrQG5vbmUuY29tPokCTgQTAQoAOBYhBCt26xro lQnUCDmtYBLILChl131VBQJnuQbgAhsDBQsJCAcCBhUKCQgLAgQWAgMBAh4BAheA AAoJEBLILChl131VJa4QAKBeAgULnjOMH1emTf3DVHD5YfqqIZjv1jQd/+fxV5ax j4kjODFq1lMIiZ6AeSzDJ7u/xPVJg8fXUvEnlUWMRVjyedAiCrkeKqzHDeYSgHe/ 6M4JBbJZo67+1CMuEMecWVGhI/EM0V9eaZnJ3E02FvURTgI8ZwATzO1c4ENZUbkx kBgobbCD6gmY+utn1+taojLErrO+NQgFPeh2O6MXXkHHV5bNC0gm3GTTlUUGZXC6 EYWmQrRyKhXwkDWk3heLWlwhkEtbAd9AHVn4XItA9gyLwiWJX7Ek+cx/utwa07sa aFoopfWUM1HrDVOSz/h/9AgFIkkVohqIH4VWP9euWWnHrn+rhdi6EBBS8wUU9ldS 3zztKOuEwd2PAwnTTUa1zTsEUAoNZH+EyLLoaJ2wfXNJU9P7b2wHl6gdiVDrf/eJ ZnLBaw6gG3TXQFVHSF2k75ylobJgQFqsMIFrgqZpKe6dCQK9BwXjbZKLJx0Gc47x oHUaIT0AmYYsdCQV0o7wdYaHFz4L2sqCEpQLTJdNpTuBgd7Errr2jBM0SD2okSOv xGwVF6vb0ya2uvZrinTPHIosgjCzT+IXXpK7QTXHJnRmIOep3O861DuuNFs5stf9 afeqhZicFBNc3Q8LRyldGfH0Xys57UP0QV82deowhxtBYXzd0pCg6tXEd5t+lGzS uQINBGe5BuABEADFsT1c6KYlkal3KOOmNxhvUlR2jzcUmcRWb8eqvNV1FHbTEZC1 T3lcYyNSz+DNzs58CV9RJIbjjElQEGVvOGZr70YxL+0Q+PqDKo328+ZLhgfuOuhI 8hvV1HYk6zmFWC2F7xzMPyaaIk3wd/fMDG2sgphdibOJ4mHu0Zqa8GSI5lyU5tEs JGOGSsY61QSWaVSYW6YP2X4RxSYT8aadSPohnAQga5Mqv960ZE0a/sVy0DStMFdu BM9IIkB2RaeW2Yxp+koqW+4aVB37hJVYXwGjHETEJlTeo3e5tJpY7iXYQrvRbE0W JG8GpwfWAKwV6wPQE/rXmjNQd7osQPHKAC5zrQPzYObmmw182s5s/84iANkUpxxL Upw5I8XMT4CqMxu6UxeMaJ0DHZRax9mfV/x9R6of6nam7SCg6sS0DhxgefU6x8UL GTFKFkhcdlNlC7CfFgCoIxMQGGLyomo4RXXrFklCG9oSvCbvyEhHqJ1nqdNOF59N CRP6rBrcLLaHrGvoY/zaJSwrPuV/8Toxk5RZ2QBZKgHCTkwvXwFzDIlGy2htBBiw JVScxWr0UB9SExKwfyda7Hd6lyEl/L8sXm6K2s+G6RG2/Q/m1QsVp8iQIgP04MZo q1SHqdFL5+ld7Zg2y4CFFybMw4r/5VwWwIKhufOC5YIjNfCBUylajuDhiQARAQAB iQI2BBgBCgAgFiEEK3brGuiVCdQIOa1gEsgsKGXXfVUFAme5BuACGwwACgkQEsgs KGXXfVWQJQ//RATFrZCLX6NRJsw5gRPiADU1nwR/PTqK8PklgPSD2F+FyWWzWA9r PJ0sAtAn9ONV+KYSJq/UOYhciYNcD1QvpMn6se/avNQUZ+D2FKrnDycOzI0hdyW/ 1hY48hu8VtxRwJNVKAs+kPse70qa+QynMMm4p4GWHkkGwR0idBgLHgd27d2Qer+g WZvPqjzwZoY4xb7kmGbPeBHL4jkvJ6yhyu3vv61rtxBgkbEgm/HTOK3LH1/SJdGR S03olUXxugH1ycSCYIFE/NQzQZFTSxdnZP2y924YFoYUzcy5d+WqRJ6DQwINxMPX sHRxd64jU97FdliyyMmfvM7Sg20cG45zu2tTDdpUX7LV33TZAOmAo6tlb256jIKg 1gkBEteuNw90t+KvUFd0CIrnKA4MbbbjaNEnqw8dNpR/SlPk18RFT5P7UwUt6fwr sBl9KRCoxSzC+WZcuhzAL0xHivvc0J1qBeP8INGjSGEdjDQ+EafmLu6EUQeto8yX ahH8FB2xf+hojx0nfZw6RFd5G5VF4rUSWlPLjjQMSwhwlx7xHq8XwrH32i5PvNRa vpU+ohb94oorQGY/mE5gq288e9Qe/1LXlkAP0VLM0El6onPQIUyV9YnI5Jjveufx MbM6xcrIac/XXN/Pf904uXpp4Qb/Js/DzNSmA7I/YxZJfvSFRCaEIWE= =dOxl -----END PGP PUBLIC KEY BLOCK-----
If a "mirror" cannot be found in a signed list, treat it as a rumor. Rumors are how fake addresses get copied.
Check three: the access queue
The real mirror starts with an Access Queue: a spinner, the line "Do not refresh the page. Please wait... you are being forwarded to the market." Then a DDOS Protection captcha: "Are you not a Robot? Click the broken circle (the one with a cut.)" A 24 second "Captcha Timeout" bar runs down. Miss it, and the screen says "THINK OF WHAT YOU HAVE DONE!" and a minute of waiting begins.
A fake mirror rarely bothers to reproduce this path. It just wants the password. If a "mirror" drops straight onto a login form with no queue and no captcha, count it as someone else's.
What a fake mirror actually looks like
It looks fine. That is the point. The design is close enough, the categories are there, the products even have pictures. The tells are in the details:
- It is open over the clearnet, not over Tor. No .onion, no queue, no reason to hide.
- The last six characters do not match the signed list.
- There is no access queue, no captcha, no "Do not refresh the page."
- It carries urgent "official announcements": the market is moving, funds must be confirmed, a new address replaces the old one by the weekend.
Urgency is the tell that costs the most. The market does not announce in a hurry. It signs a list and lets the list do the talking. Compare the address against the list, check the signature, and if the queue appears, you are probably where you meant to be. The current addresses live at addresses, and the clones that imitate the login screen are collected at clones. When it is time to actually type a password, see login.