The five second check that prevents almost every loss

Almost everybody who loses something around a market like this loses it to a copy of the login page rather than to the market itself. That is good news, because it is the one part entirely under your control.

Why clones work

Assume a clone is visually perfect. It can lift the stylesheet, the images, the wording and the layout, because all of that is served to any visitor and can be downloaded in seconds. Judging a page by whether it looks right is therefore not a check at all.

The thing it cannot fake

BlackOps prints its onion address inside the anti-phishing image and again in the page header. A copy living at its own address cannot show you the real one in both places while still being the page you are on. Compare what the page prints against what your browser shows. They match or they do not, and there is no interpretation involved.

Run it every session

Not only the first time. The check costs a few seconds and the cost of skipping it is the account and whatever is in it. Habits that only apply on the first visit are not habits.

Where fake addresses come from

Mostly from searching during an outage, and from links forwarded in chats, often passed on in good faith by somebody who was caught themselves. Almost none arrive through a bookmark, which is the practical argument for keeping one.

One absolute rule

No genuine login asks you to type your recovery phrase. A page that asks is harvesting accounts. Close it, and do not use that address again.