How Anubis Market Phishing Clones Work

A clone is a one-character-off onion that copies the storefront and harvests credentials. It surfaces at the exact moment you are searching for the address, which is why the search itself is the risk. This page is how the clones operate, the moment they catch people, and the three checks that stop them.

How a clone works

One character off

  1. The clone registers a similar onion

    A 56-character v3 onion has a large space, and a clone picks one that differs from the real address by a single character, or by a character that is easy to misread. The clone does not need to be close to the real address in any meaningful sense. It needs to be close to the address you are about to type, the one you found by searching.

  2. The clone copies the storefront

    The clone loads the same interface, the same category strip, the same login screen. It does not need to host the market. It needs to host the login, because the login is where the password goes. A clone that copies the storefront and the login is enough to take an account.

  3. The clone surfaces at the moment you search

    The clone is built for the moment an outage happens and you search for a replacement address. The results that surface at that moment are built for that moment, because the clone has been indexed for the query you are about to type. The search is the risk, not the outage.

  4. The clone takes the password

    You type the password into the clone's login, and the clone has it. If you use PGP two-factor, the clone also has the challenge, and without your private key it cannot decrypt it. The detail is on the login page.

The three checks that stop a clone

Check the address before you type. Hold the address in your bar against the one the login screen prints. They must match before you enter anything. This is the one check a clone cannot fake, because the clone cannot change the address in your browser bar. The full method is on the verify address page.

Do not search for the address during an outage. Keep the mirrors saved somewhere you can reach without a search engine. The search is the moment a clone is built for, and the results that surface at that moment are the ones that took the account.

Use PGP two-factor. A phished password without your private key gets the attacker exactly nowhere, because the challenge only your private key can decrypt.

What a clone cannot copy

A clone can copy the storefront, the login, the category strip, and the captcha. It cannot copy the address in your browser bar, because that address is the one you opened, not the one the clone chose. It cannot copy the PGP challenge, because the challenge is encrypted with your public key and only your private key decrypts it. And it cannot copy the escrow, because the escrow is on the real market, not on the clone.

The moment that catches people

Not the first visit. Not the careful visit. The moment is the outage, when a mirror will not open and you search for a replacement, and the result that surfaces is the clone, and you type the password because the storefront looks right and the captcha solved and the address in the bar is the one you copied from the search result. The address in the bar is the clone's address, not the real one. The troubleshooting page covers what to do when a mirror will not open, without searching.

Related

The rule

Keep the mirrors saved somewhere you can reach without a search engine. The search is the moment a clone is built for. Check the address before you type. Use PGP two-factor. Those three things stop more clones than everything else on this site combined.