The address on the login screen does not match your browser Critical

This is the one entry in the database where the answer is immediate and absolute. Close the tab. Do not type a password, do not solve the captcha, do not try again to be sure.

Why it is never a glitch

BlackOps prints its onion inside the anti-phishing image and again in the header. A cloned site can reproduce the design perfectly, because the design is served to anybody who requests it. What it cannot do is display the real address while living at its own. A mismatch means the page you are on is not the page it claims to be.

If you already typed something

1. Assume that username and password are compromised and change them from a verified address immediately
2. If you reused that password anywhere else, change it there too
3. Turn on PGP two factor if it was not already on, so a stolen password alone opens nothing
4. Check the account for anything you did not do once you are back in through a verified address

How people end up here

Mostly by searching for an address while their usual one was slow, and taking the first plausible result. Occasionally through a link forwarded in a chat by somebody who was caught themselves. Almost never through a bookmark, which is the argument for keeping one.

Why this specific check works when nothing else does

Everything visible about a website can be copied. The stylesheet, the images, the wording, the layout, even the captcha design, because all of it is served to anybody who requests the page. Judging a site by whether it looks correct is therefore not a test at all, it is a guess with extra steps.

The address is different. A clone has to live somewhere, and where it lives is what your browser shows you. It can print the real address on the page to reassure you, but then the page contradicts your address bar, which is the contradiction you are looking for. There is no arrangement where a copy sits at its own address, tells you the truth about the real one, and still looks consistent.

What not to do

• Do not retype the address by hand to check, since a wrong character is how people arrive here
• Do not use the browser history entry that led you to the clone
• Do not enter credentials to test whether the site is genuine