Who is after you
Fourteen profiles. Read the first four if you read nothing else, because between them they account for most of what actually happens to ordinary buyers.
Why sort by adversary
Because it puts the incentive first, and the incentive predicts the behaviour. Once you know what somebody is trying to earn and what it costs them to try, their method stops being a surprise and their tells stop being a list you have to memorise.
It also stops the two mistakes people make with security advice. Treating every warning as equally likely, which produces paralysis, and treating the exotic threats as the real ones, which produces confidence in exactly the wrong places. Almost nobody is caught by anything clever.
Cost decides frequencyThe cheapest attacks are the most common, and they are cheap because they need nothing from the attacker except patience and a copy of a page. That is the whole reason the register is ordered the way it is.
The register
The clone operatorCopies the login page and waits. The most common and the cheapest to run.Most commonThe recycled address operatorWaits at an address you already trust. Reaches the most experienced users.Hits veteransThe fake support accountAnswers a question you asked in public. There is no support channel to impersonate.CategoricalThe outage opportunistWorks one window: the half hour when nobody can check anything.TimedThe clipboard swapperNever touches the market. Changes an address between your copy and your paste.Your machineThe credential stufferHas never heard of you. Tries a password you used somewhere unrelated.AutomatedThe off escrow persuaderAsks you to pay directly. The only genuinely unrecoverable loss on this site.UnrecoverableThe exiting vendorTrades honestly for a year, then spends the whole reputation at once.PatientThe long con accountSpends a year being genuinely helpful so one post lands.PatientThe account buyerSkips the year of patience by purchasing somebody else's history.Cheap patienceThe directory buyerBuys a link list nobody maintains and changes what it lists.Quiet handoverThe key rotation forgerAnnounces that the signing key changed, because that is the one check you cannot repeat.HardestThe gateway operatorOffers to open onion addresses for you, and therefore reads everything you send.By designThe flooderDoes not want your money. Makes the real addresses unusable so somebody else can offer you one.Enabler