Are my understandings about phishing links correct? : DarkNetMarkets | Torhoo darknet markets

If you’ve bookmarked the marketplace URL and always access it through that bookmark, you’re pretty much safe. A lot of DNM these days use anti phishing captchas where you need to fill in the missing characters by comparing the URL. This setup helps verify you’re on the legit site because phishing sites using proxy based setups usually can’t bypass these image based captchas. So yeah, always compare your URL carefully. On the other hand, if you manually encrypt your messages or sensitive info before sending, you’re good. But if you don’t, just know that on many markets your messages and order info might be shown in clear text (even if it’s encrypted on the backend). So if someone gains access to your account say through credential leak they can read everything, and if they know your withdrawal pin, they could empty your balance too.

Hope this clears up some doubts. Stay sharp.

examine the site carefully and if the IP address on the real site differs from the IP address there by even a small letter or number, it is a trap.the site may look exactly the same, but the IP address or anything specific to the site cannot be exactly the same

I think phishing site can show You your order history. It can get this data from real market site, bcs you gave them all data they needed to login when you was loging to phishing site.

1. If I have genuine market address which I have used successfully many times and it is saved in my bookmarks - it cannot change to a fishing link? So when accessing it I don't need to compare the address in capcha?

For this, I'm unsure - I'd like to think not, but I don't know how onion links are generated.


- I should be able to understand straight away that this is a phishing link because it won't have my order history.

Not true. Reverse-proxy phishing navigates this, by forwarding your request to the target site (the legitimate site). You input your username and password into the phishing site, it feeds that information to the real site, then sends the content from the real site back to you as the response (as if you're using the real site). So in that case, all of your orders etc. will appear.

I got done like this a good 10 years back on Nucleus - showed my correct balance & everything. Made a deposit. Never got it. Phished.

You can't be too careful. Check the PGP fingerprint every chance you can.

I would suggest to check the PGP everytime with "mirrors.txt", it only takes a minute

For the rest, I saw responses, but if they get access to your account, they can:

Wait until you place an order
Cancel the order and withdraw funds
Change the password and change the order address