Phishing and clone sites on Tor

Phishing clones are copies of popular onion services that trick users into revealing credentials or cryptocurrency. They are the dominant form of fraud targeting darknet users.

A phishing clone is a copy of a legitimate onion service created with the aim of tricking users into submitting credentials, PGP-encrypted messages or cryptocurrency addresses to an attacker. Research by Trend Micro and various academic groups has identified phishing clones as the dominant category of fraud affecting darknet-market users.^[1]

Mechanics of a clone

An attacker typically:

1. obtains a visually identical copy of the target’s HTML, CSS and images;
2. deploys it on an onion address whose first few characters resemble the target (so-called vanity address, generated with tools such as mkp224o);
3. intercepts login forms and payment addresses, replacing deposit addresses with its own.

Because any two v3 onion addresses that share a prefix diverge in the remaining 50-plus characters, careful visual inspection detects the clone — provided the user knows the genuine address.

How victims arrive

Clones are promoted through:

• unofficial “darknet link lists” on clearnet directories;
• top search-engine results for the target’s name, often achieved through aggressive search-engine optimisation;
• paid advertisements on Reddit alternatives such as Dread;
• forum posts in which an attacker claims to republish a mirror because the official one is “down”.

Operator and user defences

Standard operator defences are:

• publishing the canonical address in a PGP-signed canary that is reproduced on multiple independent channels;
• maintaining a stable PGP key fingerprint that users can verify against third-party archives;
• using a vanity address of sufficient length that trivial collisions are infeasible; an eight-character prefix already requires on the order of 2⁴⁰ attempts.

Standard user defences are:

• record the canonical address once from a trusted source and compare all 56 characters before every login;
• never rely on third-party link lists;
• verify PGP signatures locally rather than through a web form.

Legal status

Phishing is a criminal offence under the computer-fraud statutes of most jurisdictions, regardless of the lawful status of the target. Several individuals have been convicted of phishing darknet-market users; one widely reported case is the 2019 conviction of a Minnesota man who ran clone sites of multiple markets and was sentenced in the District of Minnesota.

References

1. Trend Micro Research (2020). Phishing on the Dark Web: An Analysis of Dark Marketplace Clones.
2. Hassan, Ahmed et al. (2022). “A Measurement Study of Phishing Attacks on Tor Hidden Services.” Workshop on Measurements, Attacks and Defenses for the Web.
3. U.S. Attorney, District of Minnesota (2019). Press release: sentencing in dark-web phishing case.