Community monitors keep seeing “mirror list” posts that intentionally include one or two live addresses next to phishing onions. The mix is the attack: readers stop verifying line by line once they recognize a familiar working link.
Impersonation accounts on forums paste the blend as a public service. Legitimate-looking formatting, timestamps, and a couple of real strings do not make the rest safe. Adopting a full list from chat is how wallets empty.
Desk rule
Never replace your whole set from a paste. Update one market at a time from Dark Markets. Prefer PGP-signed rotations. Delete dead bookmarks so autocomplete cannot send you into a clone.