Omega Market phishing and clone sites

Phishing sites copy the Omega Market phishing layout to steal your session and funds. These clones look identical to the real thing but host different servers. Checking the onion address before typing anything is critical for safety.

Three patterns

Attackers use three main tactics to build convincing copies.

• Prefix trap: the URL starts with words like "secure" or "official" before the real address.
• Character swap: one letter in the middle of the string is replaced with a similar symbol.
• Stale directories: old bookmark lists contain links that were valid years ago and now redirect to attackers.

The 20 second check

Run this check before every session to avoid losses.

1. Count the characters in the onion address. It must be exactly 56 letters.
2. Verify the PGP canary text matches the current announcement.
3. Confirm you are in Tor Browser, not Chrome or Firefox.
4. Never type your password until you have confirmed the canary is correct.