Verifying an address

1. Compare the characters

Copy the address from the signed list on the market page. Paste it into the Tor Browser address bar. Then read the last six characters of what is in the bar and the last six of what you copied, out loud if it helps. Onions have no spelling correction: one letter off is a different network location, not a typo.

Example, with the first Nexus mirror: nexusma2iekjhhyenua3u4zlyfsj2ubwxr2nt6gdte5rvwukzze63fyd.onion. The check is the tail: 63fyd.onion. If your bar ends differently, you are not on Nexus.

2. Read the fingerprint in the captcha

Some markets, Nexus among them, render the onion's fingerprint inside the login captcha. The image is a second copy of the address, one the phishing page has to redraw. Compare it to the address bar. When the two disagree, the page is lying about where it is, and the password you are about to type is going to the liar.

3. Check the PGP signature

Every market page here carries a signed mirror list: the market's public key, the fingerprint, and a signature over the exact addresses. The desktop check is one command:

gpg --import mirrors.pub
gpg --verify mirrors.asc

"Good signature" means the list was written by the holder of the private key, and the addresses in it are the ones the market calls its own. If the address you are sitting on is not in that list, you are not on the signed market, and no amount of familiar UI changes that.

The signed list for BlackOps is blackops5l63qnwnmlnsfvtlu66md3x3vp3fdtpna42eq7ozujr67hid.onion and two siblings. Verify against the key on its page, and the three addresses stop being claims.

4. Watch the access queue

TorZon fronts every mirror with an access queue, a waiting page with a countdown. Open torzon4v7bcakvo7qikdfknewj4dlr44hkyv4jyfrkl7ci3zqn76kiid.onion at a busy hour and the queue sits there on purpose. A queue under load is the real thing arriving. A mirror that skips the queue and lands on a perfect login page is either a good day or a very good screenshot, and the character check is how you tell.

5. Read the canary

BlackOps publishes canary statements: a phrase on the live page that changes with each release. An old canary means an old page, rebuilt from a screenshot and waiting for a customer. The canary turns "does this look right" into "does this say what the latest statement says".

The order matters

Characters before the password. Signature before the deposit. Queue and canary on the first visit to a market, and on every visit after a mirror change. None of the checks take more than a minute, and none of them require the market to do anything. That is the point.