Telling the real market from a copy

Here is the thing about .onion addresses that makes checking them necessary: nobody verifies them for you. A domain has a registrar, a certificate, a paper trail. An .onion address is a string, and any string can be pointed at any server. A copy of AWazon Market costs its maker a server and some patience. The copy will sit at its own address, look almost exactly like the market, and wait for someone who copied a wrong character. The check below exists because the wrong character is not a rare accident; over 56 characters it is a probability, not a risk.

The five-point check

1. The address bar shows the full .onion. All 56 characters plus the extension, nothing in front. If the market is displayed under a subdomain of an ordinary website, an onion viewer sits between you and the market and sees every byte. That is a gateway, not an address.
2. Count the characters once. 56, no more, no less. The copy button hands over exactly the right string, so if your count differs, a paste went wrong somewhere and the fix is to copy again, not to edit.
3. Compare the last six characters. They are highlighted in blue next to every address above. Six characters against the address bar takes three seconds and catches the large majority of typos. On a first visit, do the full 56 too, once.
4. The first screen is the queue. A white page, a spinner, "Do not refresh the page." A copy rarely bothers to fake a queue, because a queue is not impressive. If the first thing you see is a login form, a balance, or a deposit box, stop and re-check the address. What the real entry screens look like
5. Then the circle test, then the store. After the queue comes the dark "Are you not a Robot?" screen, and after that the storefront: category tiles, a search bar, seller ratings. A market that skips straight from the address to your wallet has more interest in you than the real one does.

Phrases that give a copy away

Scams in this space reuse a small set of lines, so a few are worth memorizing. "Your account is suspended, verify your balance to restore it." "Your parcel is held at customs, pay the release fee." "New security policy: deposit X to unlock withdrawals." A real storefront does not put paywalls in front of its own users' balances, and it does not collect release fees for parcels it has not shipped yet. If the first message from a new address is a fee, the address has found its victim, not its visitor.

After the check

Once the address passes all five points, the normal rules of the market take over: your account, your password, your 2FA, your escrow. How those work and where the password belongs: the account and the login screen. And when in doubt, the tiebreaker is behavior, not appearance: the market you verify today should still show the queue tomorrow, and an address that has no queue one morning and a "verify your balance" banner the next has not changed its mind, it has changed its address.