Anti-Phishing Guide: Protecting Against Fake Darknet Sites

The Scale of the Phishing Problem

Phishing sites mimicking darknet marketplaces are among the most prevalent threats to user safety. These fraudulent sites are designed to steal login credentials, redirect cryptocurrency deposits to attacker-controlled addresses, and harvest personal information from unsuspecting users.

Unlike clearnet phishing (which is limited by HTTPS certificate verification), anyone can register any .onion address. The barrier to creating a convincing phishing mirror is low — the attacker simply copies the legitimate site's HTML and CSS, registers a similar-looking onion address, and promotes it via forums, search engines, or spam. Some phishing operations maintain dozens of mirror sites simultaneously.

How Phishing Attacks Work

Fake Mirror Sites

The most common attack. Attackers create pixel-perfect copies of a marketplace's login page. The URL differs from the real site by one or two characters — easily missed without careful inspection. When a user logs in, credentials are captured and immediately used on the real site to drain balances.

Deposit Address Replacement

More sophisticated phishing sites appear functional but silently replace cryptocurrency deposit addresses with attacker-controlled addresses. Users believe they're funding their marketplace account but send funds directly to the phisher.

Search Engine Promotion

Phishing operators submit their fake sites to Tor search engines and directories, often paying for prominent placement. Never use search results as your source for marketplace addresses — these results frequently place phishing mirrors above legitimate sites.

Forum Link Manipulation

Forum posts, social media messages, and even Wikipedia-style community pages can be edited to replace legitimate links with phishing addresses. Verify every link independently of where you found it.

Core Anti-Phishing Practices

1. PGP Signature Verification

Every legitimate darknet marketplace publishes a signed list of its official onion addresses. The signature can be verified with the market's public PGP key, proving the list came from the actual market operators.

Process:

1. Obtain the market's public PGP key from multiple independent sources
2. Import the key: gpg --import market_pubkey.asc
3. Download the signed link list from the market (via Tor)
4. Verify the signature: gpg --verify links_signed.asc
5. Only use addresses from a verified signed document

2. Bookmark Immediately After First Verification

Once you've verified an onion address through PGP, add it to your Tor Browser bookmarks immediately. For all future visits, use only this bookmark. Delete the bookmark only when you've verified a new address from a new signed document.

3. Character-by-Character Address Verification

V3 onion addresses are 56 characters long. Phishing sites use addresses that are visually similar but differ in 1-3 characters. When accessing a new address:

• View the full address in the Tor Browser address bar (click to expand if truncated)
• Compare each character group against your verified reference
• Pay particular attention to similar-looking characters: 0/O, 1/l/I, rn/m, vv/w

4. Clipboard Malware Awareness

Clipboard-hijacking malware monitors your clipboard and automatically replaces cryptocurrency addresses with attacker-controlled addresses the moment you paste. Defences:

• Use Tails OS — clipboard contents are cleared between applications
• After pasting any cryptocurrency address, visually verify the first 6 and last 6 characters match the source
• Consider typing addresses manually for high-value transactions

5. Social Engineering Awareness

Phishers use social engineering tactics to create urgency:

• "Market is migrating to a new address — use this link now"
• "Your account will be suspended unless you verify within 24 hours"
• "Urgent security alert — please log in via this link"

Legitimate marketplaces never contact users through external channels. Any unsolicited message with a link is a phishing attempt until proven otherwise.

Recognising Phishing Sites

What to Do If Phished

1. Do not log into the real marketplace with the same password — change it immediately
2. If cryptocurrency was sent to a phishing deposit address, assume it is unrecoverable
3. Consider the compromised pseudonymous account "burned" — create a new identity
4. Do not attempt to contact or retaliate against the phishing operator
5. Report the phishing address to the legitimate marketplace's official communication channels

Tools and Resources

• GPG4Win — GnuPG for Windows (PGP verification)
• GPG Suite — GnuPG for macOS
• Tails OS — Includes GPG, Tor Browser, clipboard protection
• Tor Browser — Official browser for onion access

Proceed to the Verified Login

After reading and applying these anti-phishing practices, you can proceed to access the marketplace through the verified login gateway, which uses only PGP-confirmed addresses.