Section 05 · Phishing & clones

Phishing, clones and "mirrors": how a marketplace name is used against people

A famous marketplace name does not lead to a marketplace. It leads to an economy — of fake "mirror lists", login clones and "recovery" services — whose product is the money of the people searching for one.

Why the name is bait

Marketplaces disappear constantly — seized, exit-scammed, or quietly gone — while the demand to find them does not. That gap between a vanished platform and persistent searches is the raw material of the clone economy. Professional trackers describe the ecosystem's churn plainly: major markets can vanish while "new platforms emerge to attract displaced vendors and buyers". [1] Every disappearance breeds a wave of pages promising to know where everyone went.

Assessment This page describes the pattern as this project reads it from documented cases. Individual pages change constantly; the mechanics below do not.

What you will meet

• "Mirror lists" and "verified links" pages. Directories that claim to track the official addresses of a marketplace. Their business is clicks, referral arrangements and phishing — and their product is the visitor. A directory's incentive is to keep you searching, not to protect you when you stop.
• Login clones. Copies of a marketplace's login page, built to harvest credentials you type — and anything else you enter alongside them. A clone can be pixel-perfect precisely because it only needs to imitate, not to work.
• Fake support and "recovery" services. Accounts that approach people who lost money, offering to retrieve it for an upfront fee. This is the second wave of the same operation: the first took the deposit, the second takes the fee for "getting it back".
• Exit-scam follow-ups. After a market's operators walk away with deposits, pages appear promising to "unlock" or "recover" withdrawals on payment of a fee, a tax or a deposit. There is nothing to unlock. The money is gone, or it was never there.
• "Security notices". Reassurances that a given page is the "official" one, complete with warning banners, badges and support channels. These exist because trust displays work. They are a technique, not evidence.

Why a "security notice" proves nothing

Trust signals are the first thing a clone copies. A page that declares itself verified is demonstrating that it knows what verified looks like — it is not demonstrating that anyone verified it. There is no authority that certifies marketplace addresses, no register of "official mirrors", and no reason for anyone holding a working address to advertise it in search results. A site that publishes marketplace links is monetising the person who clicks. That is the entire mechanism.

This site publishes none, in either direction, and will never ask anyone to prove they are "the official" anything.

Rules that always apply

• No page that hosts marketplace links can be treated as trustworthy — including any page that claims to warn you while hosting "the good links".
• Never enter a password, a wallet seed phrase or identity documents on a page you reached through search ads, directories or "mirror" lists.
• Urgency is a weapon: "last working link", "limited registration", "act now" are engineering aimed at stopping you from thinking for ten more seconds.
• If you have already lost funds: report to your local police; in Canada, to the Canadian Anti-Fraud Centre; and if crypto left an exchange account, tell the exchange quickly.
• Do not pay anyone who approaches you first offering recovery, unlocking, or "release" of funds. Legitimate services do not cold-call their victims.

The uncomfortable part

Assessment The same ecosystem monetises both ends of the story: the person trying to get in — through directories and clones — and the person trying to get money back — through recovery scams. The documented cases make the shape clear: when Incognito's operators turned on their own users in 2024, they demanded US$100 to US$20,000 per user to keep transaction and chat records private. [2] The market, the clone and the "recovery" pitch are not three businesses. They are three bites of the same apple.

Sources

1. Searchlight Cyber, "Dark Web Marketplaces" guide (updated 27 August 2026). slcyber.io/learn/dark-web-marketplaces↩
2. TRM Labs, "Operation RapTor: The Largest Darknet Takedown in History", May 2025 (Incognito extortion details). trmlabs.com↩

Statements of fact are referenced. Assessments are labelled. Full sourcing policy on For researchers.