Fawkes Security Hub

Avoiding Fawkes Market Phishing

A phishing clone is a pixel-perfect copy of the market's login page on a domain the attacker controls. You log in; they harvest the password; your balance becomes theirs. It is the number-one cause of darknet losses — and it is almost entirely preventable with one habit: read the URL before you type.

Where the fakes come from

Search results & ads

Phishers buy ads that appear above the real market and register look-alikes that rank for "fawkes market link". The first result is not necessarily the real one.

Downtime panic

When a market is slow, buyers hunt for "new links" — and phishers post them, in forums, comments and chat groups. Downtime is their harvest season.

Look-alike domains

Extra words ("fawkes-market-login"), hyphens, swapped letters (rn for m), wrong endings (.co, .shop, .io). Cheap to register, effective in thumbnails.

"Mirror" spam

Any "unofficial mirror" not listed at fawkes.sc should be treated as a trap, whatever it looks like.

The ten-second check

# Before entering your password, EVERY time
1. Read the domain, character by character
2. Compare with the official list (below / fawkes.sc)
3. Clearnet? Confirm the HTTPS padlock — no warnings
4. 2FA challenge appears as normal? Good sign
# Takes ~10 seconds. Catches ~100% of clones.

The only genuine links

Access pointURL
Tor onionfawkesgrixgdi6mepgocuntt34o73okuasaxmuqyu4miskuhhzp2dgad.onion
Clearnet 1fawkesmarket.ru
Clearnet 2fawkesnetwork.ru
Clearnet 3fawkesmarket.com
Clearnet 4fawkesmarket.in

Anything else — treat as hostile until verified at fawkes.sc.

Your safety nets (in order)

  1. Bookmarks. You reach the market by clicking, never by searching. Phishers' sites get zero chances.
  2. PGP 2FA. Even a successful phish yields a password that can't log in. See the 2FA guide.
  3. Certificate awareness. A warning page on a "mirror" means stop, never click through.
  4. Small balances. Worst case, worst day — the damage is capped at what you chose to risk.

I think I just logged into a fake — now what?

  1. If 2FA is enabled: probably fine, but change your password immediately from a verified link.
  2. If not: log in via a verified link right now, change the password, and withdraw your balance to your own wallet.
  3. Watch for odd behaviour (missing 2FA challenge, changed withdrawal address) and act fast if you see it.
  4. Then enable 2FA — this scenario is exactly why it exists.

FAQ

Are link directories like this one safe?
Treat any directory — including us — as a starting point. The gold standard is fawkes.sc plus PGP-signed announcements. We publish the same links fawkes.sc does; the habit that protects you is verifying at the source.
Why do search engines show fakes first?
Ads and SEO. Search engines don't reliably police darknet-market results — it's not their priority, and phishers optimise relentlessly.
Can the onion address be faked?
Not realistically — v3 onion addresses are cryptographically derived from the service's key. The realistic risk is typos when typing 56 characters by hand, which is why copy-paste beats typing.

Next steps