Phishing against Torzon, Nexus, and We The North stays loud in 2026 because clone UIs are good enough to fool a hurried glance. This checklist is the floor, not a vibe. If any step fails, stop.
Save your baseline on Dark Markets before you need it. During an outage you will not invent better discipline.
- Onion came from your saved Dark Markets list — not from an ad, DM, or “updated paste.”
- Anti-phishing phrase matches your baseline before the password field appears.
- No seed-phrase, recovery wallet, or “verify ownership” prompts on first load.
- No urgent staff chat demanding deposits to a temporary address.
- Second mirror already bookmarked if this onion dies mid-session.
Clones reverse the order on purpose: form first, verification later. “Later” is when the damage is done. If the phrase is missing, leave — do not “try anyway.”
Related: Mirror hygiene · PGP before password.