How to Spot a Copycat Directory: Domain Age, Mirror Lists and Signature Mismatches in 2026

Two directories claim to list the same market. One is a mirror, one is a clone. On screen they look identical down to the PGP block at the bottom. If you paste the wrong .onion into Tor Browser, you don’t get an error page, you get a login form that harvests your credentials and a wallet address that isn’t the market’s. The only thing standing between you and that outcome is knowing how to tell a copycat directory from a real one, and doing it before you click.

This is investigative methodology, not an access guide. Nothing here tells you how to reach a market. It tells you how to look at infrastructure claims the way a forensic analyst does, because the copycat problem has gotten worse as the real directories have gotten slower to update.

Why domain age is the first thing you check

The domain-age signal has been abused on the clearnet for years, and the same logic transfers to onion infrastructure. Security researchers documented a multi-month domain registration pattern in a ScreenConnect abuse campaign, where attackers registered their infrastructure well in advance rather than in a burst right before launch. The report notes this was “deliberate operational security and awareness of domain-age scoring in search engine ranking algorithms,” since older domains with established registration histories rank more readily. Copycat directories follow the same playbook, except the “ranking” they care about is which result a nervous user clicks first.

An onion address itself doesn’t have a registration date you can query the way you can with a clearnet domain. There’s no WHOIS for .onion. So the age signal has to be reconstructed from secondary evidence: when the address first appeared in community archives, whether it’s been cited consistently over months, and whether it shows up in historical snapshots of the directory that vouches for it. A directory claiming to be an “official mirror” that surfaced two weeks ago is not an official mirror. Official mirrors get announced by the market’s own signed channels, not by a fresh directory trying to rank for the market’s name.

The ScreenConnect case is a good analog because it shows attackers thinking about timing. Someone registering a lookalike directory months ahead of a market’s relaunch, or in the quiet period after a seizure, is doing the same math. They want the address to have a little history before the mark arrives.

What you can’t do, and should not pretend to, is trust a directory’s own claim about its age. A “since 2023” banner on the page means nothing. It’s a string of HTML. Pull the evidence from outside the directory.

Mirror lists are the weak point almost every time

Curated directories exist precisely because search engines are hazardous. As one analysis of dark web search puts it, search engines “index everything, including thousands of fake scam sites designed to steal your cryptocurrency,” while a directory “acts as a verified address book.” That’s the theory. In practice, the verified address book is only as good as its signature chain, and mirror lists are where that chain usually breaks.

Directories like Tor.Taxi and Dark.Fail are named in the same analysis as community watchdogs that “provide PGP-verified .onion links to ensure you are visiting the real forum and not a hacker’s mirror site.” Fine. But “PGP-verified” has to mean something checkable. Ask yourself three questions about any mirror list you’re reading:

• Who signed the entry, and is the signing key the same one that signed the previous entry for that service?
• Does the signing key match the key the market itself publishes on its own primary address?
• When was the list last updated relative to the market’s most recent signed announcement?

If the answer to any of those is “I don’t know,” you haven’t verified anything. You’ve read a claim.

The signature mismatch is the tell that matters most. A copycat directory can reproduce a market’s branding, copy its CSS, and even scrape its current victim or listing counts. What it cannot easily do is forge a signature under the market’s real key. So if the directory shows a signature block that doesn’t verify against the market’s known public key, or if it shows a “updated key” alongside a fresh address, stop. A changed key on a mirror is a red flag on its own, unless the market independently announced the key rotation through a channel you already trust.

The subtle version: real key, wrong address

Some copycats don’t bother faking the key. They paste the market’s genuine public key block unmodified and attach their own .onion address to it. If you only glance at the key fingerprint and see it matches, you approve the address. This is the attack that catches experienced users, because the artifact you’re checking is real. The key doesn’t sign the address in most directory layouts. It just sits next to it.

So the check isn’t “does the key match.” It’s “does the key actually sign the address I’m about to use.” Those are different tests, and only the second one is useful.

Signature mismatches beyond the key block

Directory listings fail on consistency in ways that aren’t cryptographic but are just as diagnostic. A directory that lists a market’s escrow policy, fee schedule, or admin handles that contradict the market’s own published history is either stale or fabricated. Neither is a directory you should be routing through.

The 0APT episode is the cleanest recent illustration of why a listing should never be taken at face value on its own. In late January 2026, an outfit calling itself 0APT appeared from nowhere and claimed more than 200 victims within about a week. The volume was implausible for a group with no history, and researchers at GuidePoint, Intel 471, and S-RM independently concluded within days that the list was largely fabricated, mixing invented company names with real household brands to borrow credibility. One invented victim, “Metropolis City Municipal,” was lifted from DC Comics. The files 0APT claimed to hold were masked to look hundreds of gigabytes and never finished downloading. In April 2026, a rival group called KryBit breached 0APT and published its logs, confirming the 190-plus victim list had been fabricated from the start.

Read that as a directory problem, not just a leak-site problem. The same mechanical failure, a fabricated entity borrowing the credibility of real names it sits next to, is exactly how a copycat directory operates. It lists a genuine market alongside a fake mirror of that market, and the real name lends cover to the fake one. If the trackers had a verified-signature model for leak site claims the way they’re supposed to for mirrors, 0APT would have been flagged in hours instead of weeks.

Volume and burst patterns as a directory tell

Genuine operations grow. Fabricated ones spike. The 0APT case shows what an implausible burst looks like on a leak site. On the directory side, the equivalent is a listing that suddenly adds a dozen new “official mirrors” for established markets in a single update, or a directory whose entire catalog appeared in one week. Legitimate mirror additions trickle. If a directory is dumping addresses in bursts, either it’s scraping from somewhere you can’t see, or it’s manufacturing entries.

LockBit 5.0’s posting behavior is instructive here for a different reason. Every one of its biggest posting days arrived as a burst rather than a trickle, 34 victims on one occasion, 62 on another. That’s a real group trying to look busy after a long silence. A copycat directory trying to look authoritative does the same thing: padding its list to look comprehensive, because comprehensiveness is what a user is shopping for.

What actually works, in order

Start with the market’s own signed channel, not with any directory. Whatever the market publishes through its own key is the root of trust. Everything else is derived.

Then check the directory against that root. Does the key on the directory match? Does the key sign the address on the directory, or is it just displayed nearby? Does the address appear in the market’s own signed announcements?

Then check recency. Directories that haven’t updated against the market’s last signed announcement are stale. In a 2026 environment where markets have been reshuffling, seizing, and relaunching, stale is indistinguishable from malicious on first read.

And check the provenance of the search path that got you there. If a dark web search engine surfaced the directory, treat the result as an untrusted advertisement. As the same analysis notes, experienced investigators don’t rely on search engines for this exact reason. Exact-match quoting and hyper-specific queries reduce junk, but they don’t eliminate scam infrastructure, because scam infrastructure is designed to match your query.

None of this is fast. Checking signatures and cross-referencing archives takes time, and the person who registered a lookalike domain three months ago is counting on you not doing it. That’s the whole game. Domain age buys them a moment of your trust. A mirror list borrows a name you already trust. A signature block displays a key that was never meant to vouch for the address beside it.

Assume every directory is compromised until its signatures prove otherwise. Then go check whether the signatures were proving the right thing in the first place. That distinction, between a key that exists and a key that signs the specific address in front of you, catches more copycats than any blocklist does.

Research only. Don’t test any of this against live infrastructure.