How the fakes look

Black Ops Market addresses

All three open the same market. Copy one and paste it into Tor Browser.

• blackops5l63qnwnmlnsfvtlu66md3x3vp3fdtpna42eq7ozujr67hid.onionCopy
• blackops6kignp3eddmvqcfkjzf6qr6haxbmkypc2xtqlnhuu4ak4dqd.onionCopy
• blackops27m32abqvbhnyswgazqawxqbznbzkkkv5sjo7gve2ndpsdad.onionCopy

A fake does not need to be good. It needs to be open, to look close enough at a glance, and to ask for your password before you have noticed the difference. Everything below is a shape that has actually been seen in the wild, not a warning from a brochure.

The look-alike onion

One or two swapped characters, sometimes a different prefix: blackopz, blackopshub, b1ackops. It opens a copy of the market, usually a copy of the login screen specifically, and you type the password you would have typed anywhere. The copy looks right because it was made from a screenshot. The address is the only part a screenshot does not give away, which is why the prefix, length and last-six check exists.

The old address

A real address from two years ago. The market has moved on, the old onion still resolves to something, and someone who noticed put their own login page behind it. Old forum threads, old bookmarks, old PDF guides: the main supply lines. If the address you are holding does not match the ones on these pages, treat the match as the thing to verify, not the address.

The clearnet copy

The market’s look, rebuilt on a .com, .to or .shop domain, sometimes with the real onion embedded in a .watch or .to tail. It loads instantly, because it is not the market. The gateway in the middle reads your traffic end to end, and the login form at the end of it is where the reading is for.

The migration

A page announcing the market has moved, with a form that will “transfer your old password to the new address” in one click. Nothing transfers. You have typed a password into a stranger’s form, and the button was the transfer. Markets that move do not need your cooperation to do it. A new address is enough; a new address plus your old password is a business model.

When you have already typed it

If you handed your password to a page you are now unsure about: change the password from the real onion, on an address you verified with all three checks. Turn two-factor on if it is not on. Assume anything ordered or sent during the suspicious session needs a second look, and check the wallet balance before you start worrying about the rest.