How to verify you are on the real market
A clone copies every pixel of the storefront, the sidebar, the banners, even the queue page. What it cannot copy is the address in your browser. So the check falls on you, and it takes less than a minute if you know where to look.
The address bar is the only authority
The design, the logo, the queue page, the banner at the top of every page: all of it is copyable. The only thing that is not is the 56 characters in the address bar, because that is the address your browser is actually talking to. Everything else is a picture someone could have redrawn.
Practical trick: open a plain text editor, paste the full onion from the addresses page into it, then paste the contents of your browser's address bar into the same file, one under the other. Now compare. At minimum, match the first eight characters and the last eight characters, character by character. If the last eight differ, you are not on the real market, no matter how perfect the page looks.
The banner and the captcha
The market prints the canonical onion in a banner at the top of every page load, so a second independent copy of the address sits right on the page itself. On top of that, the login captcha image has the operator's fingerprint baked into it. A clone would have to match the address bar, the banner, and the captcha fingerprint at the same time, and the captcha additionally requires a key held by the operator. That is a lot of things to fake in one go.
What a phishing copy looks like
Pixel-identical UI. A banner telling you the market "moved to a new address". A deadline, a low balance, something urgent. And the address comes from a Telegram post or a chat message, not from a signed source. The giveaway is the prefix: the vanilla prefix "awazon" is cheap to repeat, so copies keep those first characters and randomize the rest. If the last eight characters do not match the set published on Dread, the prefix matching is exactly what you would expect from a copy.
Where the official set is published
The operator publishes the current set of addresses as PGP-signed posts on the Dread forum. That is the only official channel. The public key is registered under the e-mail f@[email protected], and its fingerprint ends in 12C82C2865D77D55. The addresses in this directory match the last signed set we were able to verify. If you can check PGP signatures yourself, do it: that is the strongest check available, and it does not depend on trusting us.
If something does not match
Do not log in. Do not deposit anything. Close the tab and come back through the three addresses on the addresses page. If you already entered a password or sent funds, the damage is real and a copycat will not undo it, so treat any further action with extra care. For the mechanics of what to try when an address will not load, see troubleshooting.