Verification // PGP canary
Verifying a BlackOps Mirror Address
A mirror address is just a string of characters until you prove it belongs to the right place. Anyone can register a .onion domain that looks almost identical, serving a clone page designed to steal your credentials or your XMR. The market relies on a cryptographic signature to prevent this confusion.
The five-step check
Every official mirror list is signed with the admin team's 4096-bit PGP key. That signature acts as a canary. If the math checks out, the list came from the people who run the market. If it does not, you are looking at a lookalike. Treat the signature as the only authority here.
- 01
Import the PGP key once
Download the admin key from a source you already trust and import it into your client. Do not skip the fingerprint check. Verify that the fingerprint matches 7E0B 9668 ED36 0856 9184 FDCA 1B5F 02D5 C74C C809.
- 02
Fetch the signed canary list
Pull the latest mirror list directly from the market's official channels. This document contains the current .onion addresses along with the PGP signature block. Save both files locally before you begin checking anything. Keep them separate during the process.
- 03
Verify the signature against the key
Run the signature check using your imported key. Your software will output a result indicating whether the signer matches the public key. You want a good signature with no warnings. A bad signature means someone else touched the file.
- 04
Compare your address character by character
Take the address you intend to visit and align it with the entry in the signed list. Compare every single character. One misplaced digit changes the destination entirely. Do not rely on visual similarity or partial memory of the string.
- 05
Enter credentials only after confirmation
Once the address matches the verified list exactly, proceed to log in. If any part of the chain failed, treat the destination as unknown. Clear your cookies and wait for the next confirmed cycle before entering sensitive data.
When the check fails
A failed check
A failed check usually presents as a mismatch warning or a missing signature. The address might still load a valid-looking shop, but you cannot confirm who runs it. Stop typing your password. Consider the address unconfirmed until the math works again.