What they copy, what they cannot, and when they catch people.
A clone is not a crude imitation. It is usually a perfect copy of the market at an address that is not the market, and it exists to collect what you type.
Everything visual is served to anybody who loads the page. Stylesheets, images, wording, the login form. Copying it takes minutes and requires no skill. Clones often look better than the original, because whoever built one wants you comfortable enough to type a password without pausing.
The address. An onion address is derived from a key the operator holds, and no amount of copying produces the matching key. So a clone has to sit somewhere else, and your browser address bar shows where you actually are. Printing the real address inside the market login turns that into a visible contradiction.
Generating an address whose first characters match a target is cheap. Matching the tail is not. That is why lookalikes have familiar beginnings and random ends, and why comparing from the end backwards is the correct way to read the check.
Clones rank because the only moment anybody searches for a market address is when the familiar one has gone quiet, and everybody searching then is anxious and in a hurry. That is not a coincidence, it is the business model. Waiting out an outage costs nothing, because nothing in an account expires while the storefront is unreachable.
Assume it is gone and change it anywhere else you reused it, which is where the real damage usually lands. Do not send anything to any address that page offered. Return through an address you already had and check the account from there.
Nexus Market