FAKE MIRROR // ANATOMY
Spot a Fake WeTheNorth Mirror
A clone rarely looks wrong. It gives itself away by what it does: asking for a login too early, quietly changing the onion, painting on an uptime badge, or pointing a deposit at the wrong wallet. Learn the behaviour and the copy stops fooling you.
http://hn2paw7hljeihrk7qm2toniay5bb4cfz46cav5iywnsv64klm45mypqd.onionKeep this string beside whatever page you landed on. If the mirror in front of you differs by one character, or behaves in any way listed below, close the tab.
Why anyone bothers cloning it
A fake mirror is not vanity. It is a small business with two products: your login and your deposit. Harvested credentials get sold or drained, and a swapped wallet takes a payment that never reaches the market. Building the copy costs an afternoon. As long as one visitor in a few hundred connects without checking, the clone turns a profit, and that arithmetic is why they keep reappearing under fresh domain names.
Genuine board vs clone, side by side
Judge the two by what they ask of you, not by how they look. The real board sits on the plus row. The tells of a fake fill the rest.
Login stays inside Tor
The genuine market never asks for a username on a clearnet page. You reach the login only after the onion opens in Tor Browser.
Login demanded up front
A clone puts a sign-in box on the web page itself, before any onion loads. That box exists to copy your credentials, nothing more.
Onion quietly altered
The address runs a character or two off the genuine string, betting that you read the opening letters and stop there.
Badge painted green
A bright online marker with no probe behind it. The image never moves because it is baked into the page rather than measured.
Deposit address changed
The wallet shown for a top-up belongs to whoever runs the fake. Your coins land with them and never credit an account.
How a fake mirror turns a visit into a loss
The path is short and always the same. You arrive believing the page, you hand something over, and the operator behind the copy keeps it. Drawn out, the trap has three moves.
Four tells you can read at a glance
Lookalike domain
A tidy clearnet name that promises the market without Tor. The real board answers only as an onion.
Login first
A username field before the onion ever opens. The genuine login exists only inside the market.
Forged uptime
A green badge that never moves. An honest status reads Checking until a probe confirms it.
New wallet
A deposit address that differs from your last visit. Treat any changed wallet as a reason to stop.
Confirm the address before you act
If a mirror clears these tells, you still owe it a character check. Compare the onion string end to end, then verify the operator key on the detector home page before you type anything.
Fake mirror questions
A fake mirror showed a green online badge. Does that make it real?
No. A clone hard-codes that badge, so it is a picture rather than a probe. Only a full address compare and a matching signature carry any weight.
The page looked exactly like last time. Is that proof it is genuine?
No. A clone copies the whole look, pixel for pixel. Appearance is the cheapest thing to fake, so on its own it proves nothing.
A mirror asked me to sign in on a normal web page. Is that how it works?
No. The real login lives inside the market over Tor. A page that wants your WTN username before the onion opens is harvesting it.
Why would anyone bother cloning WeTheNorth?
Stolen logins and redirected deposits pay for the work. A convincing fake earns more than it costs to build, which is why clones keep coming back.