How to Verify You Are on the Real Anubis Market
A one-character-off onion is the most common way a clone takes an account. The address check takes ten seconds and stops it before a password is typed. This page is the full method, what to compare, where to look, and what to do if the two addresses differ.
The check
10 seconds-
Copy the address from a trusted source
Take the onion from the verified mirror list on this site, or from a source you have used before and confirmed. Do not take it from a search result, a chat group, or a link someone pasted into a forum. Those are the moments a clone is built for, and the search is the risk.
-
Open it in Tor Browser
Paste the address into the Tor Browser address bar and wait for the page to load. A cold connection to a hidden service takes tens of seconds, so give it a full minute before you judge it. If it does not open, see troubleshooting.
-
Compare the address in your bar against the login screen
Once the market loads, look at the address in your browser bar. Then look at the address the login screen prints, usually near the top of the page or in the captcha area. The two must match character for character. If they do, you are on the real market. If they differ by even one character, you are on a clone.
-
If they differ, do not enter a password
Close the tab without typing anything. Go back to the trusted source, copy the address again, and open it fresh. Do not try to fix the address by hand. Do not reload the same tab, because a reload rebuilds the same failing path. The full set of fixes is on the troubleshooting page.
Why the login screen prints the address
The login screen prints the address it is serving so that you can compare it against the one in your bar. This is the market's own way of telling you which mirror you reached. A clone can copy the storefront, but it cannot change the address in your browser bar, so the comparison is the one check a clone cannot fake.
What the tile captcha has to do with it
The login screen uses a six-tile captcha with decoy input fields whose names rotate on every page load. The captcha is there to frustrate automated phishing kits, not to verify the address. Solve the tiles in the visible field only, and do not fill the decoy fields. The full login flow is on the login page.
When none of the mirrors answer
Open any other onion service you know. That single test separates a problem in your own client from a problem at the market, and it takes twenty seconds. If nothing onion works, restart Tor Browser completely. If other onions work and these do not, wait rather than hunting, because an outage consumes nothing: escrow keeps holding, orders keep their timers, and a balance does not evaporate because a storefront was quiet for an afternoon.
The rule that matters
Never type a 56-character onion from memory. Copy it from a trusted source, open it, and compare it against the login screen. Those three steps stop more clones than everything else on this site combined.