Dark web scams: the clone uses a familiar prefix, and the checksum still passes
Dark web scams, the ones that hit people who already found a real onion, come in three shapes. A phishing clone copies the site and picks an address that starts like the real one. An exit scam is the market taking the money it was holding. A link list sends you to either of those and calls itself a directory. Matching the first few characters does not mean the address is real. The checksum in a modern onion address does not mean that either. It means the address is spelled like an address. The real check is boring: the operator publishes the address somewhere you already know is them, and you compare every character.
How a fake onion copies a real one
The useful study is old, and it is about the old addresses, which matters before you reuse its arithmetic. Changhoon Yoon, Kwanwoo Kim, Yongdae Kim, Seungwon Shin and Sooel Son, at the 2019 Web Conference, looked at 28,928 onion domains collected from January to July 2017, about 21 million pages, and confirmed 901 phishing domains. Those addresses were the 16-character kind, and Tor says that format no longer works. The mechanism they found has not retired with it.
They grouped homepages that shared near-identical text, then used something outside the page to decide which copy was the original: a seizure banner after AlphaBay's takedown, Dream Market's own domain checker, a clearnet site, a forum announcement. Without that outside clue, they wrote, there is no effective way to call a dark-web site phishing. The pages themselves were not sloppy. Bitcoin Fog's clones were login screens, visually the same, and they let a researcher create an account. The accounts did not share a database with the real service. The Bitcoin deposit address was different. You were not on a broken copy. You were on a working till.
The addresses were chosen, not stumbled into. The paper's point is that operators and copycats both brute-forced a public key until the onion started with a word they wanted. On those 16-character names, a five-character prefix was cheap, on the order of a minute in their citation of the Shallot tool, and a full 16 was not feasible. At least 67 percent of the 5,718 website groups they found had a shared prefix of five characters or more. Then the part people still get wrong:
Because both of them share the common prefix "bitcoinfog", the visitors would presume that the addresses will lead them to the BitcoinFog website. However, neither of them is the authentic BitcoinFog website.
In that group, 277 domains, one was the official address, and it did not begin with "bitcoinfog." One hundred and nine began with "bitfog." The memorable prefix was the costume. AlphaBay's set had 98 domains starting with the same five characters as a real address, and one that matched the first nine. Does matching the first few characters mean the address is legit? On the evidence of that paper, it means someone spent compute to make you think so. A v3 address is 56 characters and encodes a 32-byte key, so the vanity work is heavier than a five-letter prefix was in 2017. Heavier is not the same as impossible for a short prefix, and it is irrelevant to the rule. A shared beginning is not a signature. A copied list of "official" onions that diverges after a shared start is the same failure, measured on addresses that are still in use.
Clones are not only a 2017 market problem. A 2021 paper from Fraunhofer SIT, Martin Steinebach, Sascha Zenglein and Katharina Brandl, records a 2019 phishing site imitating The Guardian's Tor SecureDrop. The clone harvested SecureDrop codenames, the pseudonyms sources use to come back, and advertised a malware app. That is a legitimate newsroom's tool, not a market. Have sites like SecureDrop been cloned? Yes, that one was. The same paper describes the cheap version of the attack: copy the page, replace the links and the payment addresses, or sit in the middle, fetch the real page, and swap the address before you see it. Their crawl of a link list found cloned pages by the dozen, most of them wallets and shops. They also note the limit of that detector: it is trivial to build a phishing page by hand that does not trip an automatic comparison. A tool that catches the lazy copies will not catch the one made for you.
What an exit scam is
An exit scam is the operator stealing the money the site was holding, then disappearing. It is not the police seizing the servers. The history of darknet markets separates those endings, because the headlines do not. The buyer's view of one of them is in a Justice Department account of Wall Street Market.
An "exit scam" was allegedly conducted last month when the WSM administrators took all of the virtual currency held in marketplace escrow and user accounts – believed by investigators to be approximately $11 million – and then diverted the money to their own accounts. Exit scams are common among large darknet marketplaces, which typically hold money in escrow while a vendor delivers illicit goods.
Vendors noticed on 16 April 2019 that they could not collect what customers had put in escrow. German authorities executed warrants. The three men charged as administrators were arrested on 23 and 24 April, in the United States and Germany. The complaint described a market in six languages, about 5,400 vendors and about 1.15 million customers, run for nearly three years. Assistant Attorney General Brian Benczkowski's line is the timing: the administrators "decided to steal their customers' money via an exit scam" just as partners began dismantling the market. The release reports no refund of the $11 million.
That is how it plays out from the inside. The site looks normal. The escrow balance looks like yours. Then the withdraw button does nothing, or the admins announce a hack, or they say nothing. The coins have moved to wallets they control. You are not waiting on a package. You are an unsecured creditor of a criminal business, which is a polite way to say there is no desk that refunds you. Can you get the crypto back? Not through escrow, a wallet or a support ticket. A later seizure may recover some coins, but that is a government process, not a refund you can plan on. Sending more, to a "recovery" address posted on the dead market, is the next scam. How much a market can take on the way out depends on whether it holds your balance at all, and the best darknet markets of 2026 are compared on exactly that.
How to tell if an onion link is real
Nothing on the onion page can prove it is the site you meant. The 2019 paper's method was an outside clue, because the page is the thing being copied. Use a source you did not get from the onion.
- Start from a site you reached by its ordinary name, over HTTPS. The BBC's site, the newsroom's tips page, the project's own download page. If you cannot find the onion there, you do not have a reason to trust an address a search result gave you. A search engine is a lead, including Ahmia.
- Prefer Onion-Location when the clearnet site sends it. Onion-Location is a header, or an HTML meta tag, in which the site names its onion. Tor's conditions: the value has to be a valid onion URL, the page setting it has to be HTTPS, and that page has to not itself be an onion. Tor Browser turns a valid header into the purple ".onion available" pill. The pill means this HTTPS site is advertising that address. It does not mean a certificate authority checked that the onion is the brand you think, unless you are looking at a separate EV certificate on the onion itself, which is a different icon. Click the pill from the real clearnet site. Do not click a pill-like button on a page you reached from a forum.
- If the address is printed in words, compare all 56 characters. Not the first ten. The Fraunhofer paper treated six matching characters, on the old 16-character addresses, as enough to flag a deliberate clone. A human glancing at a prefix is doing the clone's work for it. Read the end as carefully as the start. The directory on this site is only useful where each row names the page the address came from. If you cannot open that page, ignore the row.
- A signed list is a list plus a signature, and the signature is the part you check. Riseup publishes its onion services as a PGP-signed message on its own Tor page, linked from riseup.net. Open that page from the clearnet site you typed yourself. Verify the signature the way the page tells you to. A screenshot of a signed list, reposted on a forum, is not the list. The signature only helps if you check it against Riseup's key, not against the page that claims to be the signature.
- Bookmark what survived the comparison, and stop taking fresh addresses from inside the site. The 2019 authors' own mitigation was a random-looking address and a bookmark, so people would give up memorising a prefix. A banner on the onion that says "we moved, here is the new address" is the clone's favourite sentence. The new address has to come from the clearnet site or the signed list, again.
| What you did | What it establishes | What it leaves open |
|---|---|---|
| The address loads | Some onion service is online at that key. | Whether it is the service you wanted. |
| The first characters match a name you remember | Someone chose that prefix. Copycats do this on purpose. | Everything about who owns the key. |
| The checksum accepts it | The string is a well-formed v3 address. A typo usually fails. The 2017 design note put a two-byte checksum at a 1 in 65,536 chance of missing a typo. | A phishing address has a valid checksum for its own key. The checksum is SHA3-256 over the public key and the version, truncated to two bytes, then base32-encoded with them. It checks the encoding. It does not look up a name. |
| The ".onion available" pill, clicked on the real HTTPS site | That site, over HTTPS, is advertising this onion. | A pill on a site you reached some other way. And a meta-tag version, which Tor notes always sends you to one fixed onion URL, not the subpage you were on. |
| A PGP-signed list on the operator's clearnet site, signature checked | Whoever controls that key published this list. | A list you did not verify, or a key you took from the same forum as the address. |
When a site says the old address is compromised
Tor's glossary calls an onion address self-authenticating: the format binds the address to the key that protects the connection. The address is not a name that can be pointed at a new server. It is the key. If the operator says the old address is compromised, they are saying someone else may hold that private key. The old address still connects, and it connects to whoever has the key. The checksum still passes, because the address is still a perfectly valid encoding of that key. Ordinary domain names can be swung by a registrar or a certificate authority. An onion cannot. That is the feature, and it is why a stolen key cannot be revoked in place.
The new address is a new key. It will not look like a small edit of the old one. Take it from the clearnet site, or from a signed list you check, and retire the bookmark. A message on the old onion telling you where they moved is exactly what the person holding the stolen key would write. If the address is simply wrong, Tor Browser's error is "Invalid Onionsite Address," code 0xF6, which is a typo or a truncated string. A compromised address does not produce that error. It produces the site, run by the wrong person.
Link lists and mirror scams
An onion mirror scam is the clone with a polite name. "Mirror" suggests the operator's backup. In the 2019 groups, the extra domains were not backups. They were separate front ends with a different till. Treat the word the way you treat "official." It is a claim, and the claim has to be on the operator's clearnet site or in the signed list. Two onions that both load the same logo are not two mirrors until the operator says both addresses are theirs.
A hidden wiki is a page of those claims, editable by whoever holds that wiki's key, which you also got from a wiki. Why those lists are a bad source is already argued with the addresses that drifted. The scam-shaped version is worse than drift. In March 2026 Europol described one operator's network of more than 373,000 fraudulent onion sites that took payment and delivered nothing. That is not a market exit. It is a storefront that was never a store. A search result or a wiki link into that pile looks like a site. The payment page is the whole product.
The rest of what sits on onion services, the newsrooms and the software projects, publish their own addresses because they expect this. If the thing you wanted does not, you do not have a verification path, and the honest stop is to not use it.