The clone operator
The most common adversary in the register and the least sophisticated. That combination is not a coincidence.
- What they want
- Your username and password, entered on their page, with the second factor code in the same moment so it can be replayed while it is still valid.
- How they earn
- Whatever is in the account. A balance directly, orders redirected, and the account itself resold because an aged account with history is worth more than an empty one.
- What it costs them
- Almost nothing. The page is copied wholesale from the real one. The only real expense is getting in front of you, which is why they concentrate on channels that already have your attention.
- How you meet them
- A search result, a directory entry, a forum post, a link somebody passes on, or an old bookmark. Ordinary places, because ordinary is what you trust.
- What gives them away
- Nothing visible. That is the point of this profile. The page loads, looks right, and behaves normally. Only a signature checked against a fingerprint you established independently separates it from the real thing.
- What stops them
- Verification on arrival, every time, before typing. Nothing else works, and everything else feels like it does.
Why it loads faster than the real site
A clone serves a handful of visitors from a machine doing nothing else. The genuine market serves everybody, absorbs whatever flooding is currently aimed at it, and runs the defences that flooding makes necessary. So the fake is quicker, more responsive, and never shows you a queue.
People read speed as a sign of health. Here it is weak evidence in the other direction, and somebody arriving during a slow spell and finding an address that feels snappy has found the thing they should be most careful about.
The three ways it reaches you
| Route | How it works | Why it is effective |
|---|---|---|
| Ranked page | A genuinely useful page is built and ranked honestly over months, then the addresses on it change | No spam signal to detect, because nothing was ever spammed. Anyone who checked it a year ago remembers it correctly. |
| Recycled address | An address resembling a retired one, inheriting years of links and recognition | Covered in its own profile, because the economics are different. See the recycled address operator. |
| Handed to you | A forum reply, a message, a well meaning friend who never checked either | Where it came from feels like evidence and is not. |
If you already typed something
Move on the account before the balance, because the account is what somebody can act through right now, including talking to other people as you. The ordered version is on what to do after entering credentials, and the ordering matters more than the speed.