Defeating phishing
Phishing is the risk that gets people. A clone copies the storefront perfectly and changes only two things: the onion address and the deposit addresses. Everything you recognise still looks right.
The three-second check
- Copy from a trusted source. The working links or a PGP-signed list, never a search ad or a stranger's message.
- Compare the header. The login page prints its address; it must match your bar exactly.
- Refuse the mnemonic prompt. No login asks for your recovery phrase. One that does is a clone.
Every phishing loss starts with an unverified address. Make verification a reflex and the whole category of attack fails against you.
One rule
Copy, never type. A hand-typed onion with one wrong character is exactly how you land on a clone.Last reviewed 2026-07-14.