Why these attacks and not others
The register is not a list of everything that could theoretically happen. It is a list of things that pay, which is a much shorter list and a far more useful one.
The rule that predicts everything
Attackers do the cheapest thing that works, and stop looking once they find it. That single sentence explains why the profiles cluster the way they do, why the exotic techniques people worry about barely appear, and why the defences on this site are boring.
It also explains why security advice so often misses. Advice tends to be written around what is technically interesting, and attackers are not interested in what is interesting. They are interested in what pays per hour.
Cost against reach
| Approach | Cost to run | How many it reaches |
|---|---|---|
| Copy a login page | Almost nothing | Everyone who finds it, indefinitely |
| Hold a resembling address | Minutes of computation | Everyone with an old bookmark, forever |
| Watch for people asking for help | A username and patience | A steady trickle, targeted and receptive |
| Try leaked credentials | Nothing per attempt | Millions, automated |
| Buy an aged account | A modest payment | Anyone who trusts standing |
| Build a forum account over a year | A year | Fewer, and at the moment of maximum trust |
| Compromise a market itself | Enormous | Nobody bothers when the list above exists |
What follows for you
- The boring defences cover the common cases, because the common cases are the cheap attacks and the cheap attacks all depend on you not checking one thing.
- Effort spent on exotic protection is misallocated if the basics are missing. Changing operating system while accepting addresses from strangers is protecting the wrong end.
- Urgency appears everywhere because it is the cheapest way to prevent a check, and preventing the check is what all of them need.
- The patient attacks aim at high value moments, which is why they show up during outages and around large orders rather than randomly.
Where the economics work against defenders
Reverting a bad wiki edit is manual and the edit is free. Correcting a directory reaches that directory only, while the wrong address it published has already been copied outward automatically. Publishing propagates through every mechanism at once and retraction propagates through none of them.
The consequence is structural: the total quantity of wrong addresses in circulation only grows, and the accurate fraction only falls. That is not pessimism, it is arithmetic, and it is why the useful habit is checking at the destination rather than trying to find a source that is reliably correct.
The honest conclusion
You cannot outrun the supply of bad information and you do not need to. One check, run at the point of arrival, does not care how the address reached you or how many wrong ones are in circulation. That is the whole argument of this site compressed into a sentence, and the economics are why it holds.