Verify the address, then the password

Fake mirrors do not usually announce themselves. They look right. The test below takes about thirty seconds and catches nearly all of them, because fakes have to match a 56-character string and humans are bad at matching 56-character strings.

The test

1. Know the anchors

   All three addresses begin with blackops and end in .onion. The last six characters before the dot are different for each one, and they are the fastest way to tell which of the three is in your address bar:

   Address (abridged)	Last 6 characters
   blackops5…eq7ozujr67hid.onion	r67hid
   blackops6…nhuu4ak4dqd.onion	ak4dqd
   blackops27…o7gve2ndpsdad.onion	dpsdad

2. Count

   A v3 onion is exactly 56 characters before the dot. Counting the whole string is slow; counting is mostly useful when something feels off and you want a reason. If the string in your address bar is shorter or longer than 56, it is not one of the three. Full stop.

3. Compare the ends

   First four characters and last six, address bar against your trusted copy. Both ends match and the length is right, the middle is almost certainly right too, because the fakes that survive contact with copy-paste usually differ at the ends where the typos happened. Any mismatch anywhere is a fail, and the page you are on should be closed, not filled in.

The shapes fakes take

The proxy wrapper. The full onion sitting inside a longer clearnet domain, blackops….onion.watch or .to or .click. It loads fast, which is the trap: a regular browser cannot open a raw onion, so something in front is translating it, and that something reads everything you send, password included. Fast loading here is evidence against the page, not for it.

The look-alike. One character changed, or the prefix subtly altered. The test above exists for exactly this; a single transposed letter in the middle of a 56-character string is invisible to the eye and decisive for the network.

The step that is not there. A wall that wants your email and password before you ever reach the market, a reCAPTCHA or a "verify your identity" flow, a support chat that appears before login. The real front door is brief and plain: a browser check, at most a one-picture puzzle with a 30 second timer, and then the login form. The real first screen is the login form. Everything else is a door in front of the door.

The moved market. An announcement that Black Ops "has moved" to a short normal domain. An onion market does not move to a domain a registry can reassign. That move is the account, not the market.