The outage opportunist
Not a different attack so much as a schedule. This is when the others become several times more effective.
- What they want
- For you to accept an address from a stranger, at the one moment when you cannot compare it against anything working.
- How they earn
- Whatever the clone behind the address collects. This profile is about the timing, and the timing is what makes the rest pay.
- What it costs them
- Watching for downtime, which is free, and having the page ready in advance, which is done once.
- How you meet them
- A helpful reply in a thread full of people asking whether the market is down. It reads as somebody being useful, because that is exactly what it is designed to read as.
- What gives them away
- The timing itself. An address that first reaches you during an outage deserves more suspicion than one that reaches you on a normal day, not less.
- What stops them
- Not looking. Whatever is unreachable will come back, and waiting costs nothing but patience.
Why the window exists
During normal operation a claimed new address is easy to dismiss, because you can compare it against the ones that work or simply go and see. Both of those disappear the moment the real addresses stop answering. The outage removes the comparison, raises the demand, and produces a population of people who want a solution immediately.
How an outage actually unfolds
Minutes zero to five
A page hangs. Indistinguishable from your own circuit being bad, and nobody has noticed anything yet.
Five to twenty
Retries fail, the first posts appear asking whether it is down for everyone. The cause is not established, so nothing useful can be said.
Thirty minutes to hours
Speculation hardens into assertion. Somebody claims the market is gone. Replacement addresses circulate. This is when external certainty peaks and when the real problem is usually closest to over.
Resolution
Addresses answer again, often one before the others. Staggered recovery looks inconsistent from outside and is entirely normal.
What to do instead
- Build a new circuit. Seconds, and it resolves a large share of what gets reported as an outage.
- Try the other addresses. Separates an address problem from a wider one immediately.
- Open any unrelated onion service. One question that separates a market problem from a network problem, and almost nobody runs it.
- Then wait. Genuinely the highest value action available. Most incidents are over within a couple of hours.
And read silence correctly. Nothing being announced during an incident is the expected state, because the channels for announcing anything are the same ones that are down. Treating that silence as a signal is what sends people looking in the places this adversary is waiting.