Mirror watch
Phishing clones surface within hours of a mirror rotation
By the Onionland Review desk · Filed 2026-08-23
A round of onion address changes across three of the markets we track was followed, almost the same day, by a crop of look-alike sites. The pattern is old and it is predictable: when a market rotates its address, the window between the change and word getting around is exactly when a scraped copy under a near-identical onion collects the most careless traffic.
None of this is sophisticated. The clones are static grabs of a market front page, wired to a different wallet, sitting on an address that shares a recognisable prefix with the real one. They work because people copy addresses from chat messages and search snippets instead of from a source that signs what it publishes.
A rotation is not a security event by itself. The clones that chase it are.Onionland Review desk
How to tell a clone from the real thing
Three checks catch almost all of them. First, compare the full address character by character against a source that signs its list, not a snippet. Second, look for a signature: a real project publishes a signed address of record, and a clone cannot forge that. Third, be suspicious of any page that rushes you toward a deposit before you have confirmed where you are.
Why we are reporting it this way
We are a journal, not a status board and not a directory. So this piece points you at the two things that actually protect you: an independent index that lists signed addresses, and a verify step you run yourself. We name the risk and hand you the tools rather than a link to click on faith.
What to check right now if you use any of the three markets
If you have an active order, an open dispute, or a stored login on any market that recently rotated a mirror, stop before your next visit and run the full check rather than assuming your bookmark still points somewhere safe. A bookmark records a location, not a verification — it survives a phishing swap exactly as well as a fresh search result does, which is to say not at all.
Step one: pull the current address from a signed source
Do not use a bookmark, a chat message, or a forum post as your source for the current address. Go to a directory or reference page that publishes a signed record, and copy the address from there as full text.
Step two: compare it against what you were using before
If the newly pulled address differs from what you had, that alone is not a red flag — mirrors rotate for legitimate operational reasons. What matters is that the new address you are about to use came from a signed source, not from wherever you happened to land after the old one stopped answering.
Step three: verify the signature before you log in
A working connection is not the same as a genuine one. Before entering credentials or touching an open order, confirm the address matches the signed canon the market's own operators publish. Only after that check passes should you proceed to log in, check a dispute, or confirm a delivery.
Step four: treat urgency itself as a signal
Every clone site built around a rotation window leans on urgency — "act now before you lose access," "verify immediately or your order is at risk." A genuine market rotation does not require you to skip your own verification process to avoid a consequence. If a page is pressuring you to move faster than your normal check allows, that pressure is itself the tell.