Researchers and forum moderators report a coordinated spike in phishing clones imitating high-traffic market brands. Attackers rotate lookalike addresses daily and sometimes publish fake “official” mirror pages that themselves link deeper into the scam funnel.
What Changed This Week
- Clones copying hero imagery and color systems from major markets
- Fake PGP “canaries” signed with newly generated keys
- Clearnet SEO pages ranking for market names + “onion”
Defensive Habits
Do not trust a link because the page “looks right.” Compare key fingerprints with older offline notes. Prefer multi-hop verification: forum canary → second forum → personal prior bookmark. If any source disagrees, pause.
Read the full method guide: Anti-Phishing Detection.