NM-006: Identifying a cloned marketplace page

1. How a clone operates

A clone serves a copy of the login page at an address the operator controls. It accepts credentials, stores them and typically returns an error, because an error keeps the visitor trying and produces more attempts. Some clones proxy the real market afterwards so the session appears to work, which delays discovery.

2. Signals that identify one

• The address printed on the page does not match the address bar, which is decisive on its own
• A request for the recovery phrase at login, which no genuine market makes
• A demand to lower browser security before the page will function
• Pressure to act quickly, such as a warning that an account will be closed

3. Signals that carry no information

• The page looks correct, since the design is downloadable by anyone
• The captcha appears and functions, because a clone can serve its own
• A padlock or any browser security indicator, which describes transport rather than identity
• The address begins with the familiar prefix, since prefixes are cheap to generate and clones use them deliberately

4. Prefix matching in particular

Many people check the first several characters of an address and stop. Vanity prefixes are computationally cheap to produce, and clone operators generate addresses whose openings match the genuine ones for exactly that reason. A partial match is therefore weaker evidence than no match at all, because it produces confidence without support.

5. Consequence

Only two controls in this archive actually distinguish a clone. The provenance of the address, and the login screen comparison. Everything else is either advisory or is a property a copy reproduces without effort.