Fakes and scams

How the fake mirror is built

Take a real market's vanity prefix, register a new onion that starts with the same letters, screenshot the real shop's pages, and wait. The result passes a glance. A Nexus address with the right first letters and the wrong last twenty is a different machine, and it keeps whatever you type into it.

The trick in concrete terms: the real first Nexus mirror is nexusma2iekjhhyenua3u4zlyfsj2ubwxr2nt6gdte5rvwukzze63fyd.onion, and it ends in 63fyd.onion. A copy registered by someone else can carry the same nexus head and a different tail. Same first letters, different machine. The check is the tail, and the signed list on the Nexus page says which tails are real.

Look at the Nexus mirrors on this page: three addresses, three different tails, all signed by the same key. Now imagine a fourth address with the same head and a tail the signature does not cover. That is the whole scam, and the tail is the whole check.

What the fake does next

Password first, coins second. The copy asks for your login, you type the real one because the page looks right, the copy holds it, and the coins leave from the copy while the real shop still shows your balance. By the time the address gets checked, the address does not matter anymore.

Which is why the check exists before the password, not after it. The verify page is the full order.

Exit scams

The slow version needs no fake page at all. The tells, in the order they usually appear: a "migration" to a new address with no signature, withdrawals queuing longer each week, vendor bonds quietly stopped being refundable, and support that starts moving conversations to Telegram. Each one is survivable alone. All four together are a pattern.

The TorZon page is a useful counter-example: four seasons running, addresses that rotate with signatures attached, a queue that admits its own traffic. Its first mirror, torzon4v7bcakvo7qikdfknewj4dlr44hkyv4jyfrkl7ci3zqn76kiid.onion, has carried the same head since 2022. Boring is a feature on a market's track record.

Habits that survive both

1. Verify before the password, every visit. Even when you have been to the shop a hundred times. The copy does not know your habits; it is built around them.
2. Keep the market password offline from sync. A browser profile that syncs to the cloud is a password that travels. The market password stays in your head or a local vault.
3. Withdraw on a rhythm you control. Coins sitting on a market are coins the market can delay. Regular small withdrawals make "delay" a cost, not an event.
4. Trust a new address only through its signature. Including one that arrived in a forum thread that looks like it came from the market. The signed list at Anubis covers three addresses, the first anubisgbozgus4ixulnqwqnofh7fekylnzew5alb3iklijcke2cvviid.onion; anything else a thread offers is a thread, not a signature.