Telling a rotation announcement from a forgery
Fake rotation notices outnumber real ones by a wide margin. They are not subtle once you know the shape.
The rotation announcement is the most forged document on this beat, for an obvious reason. A message that legitimately tells people to start using a new address is the perfect vehicle for telling people to start using your address.
The genuine format
Underwhelming, which is the first thing to internalise. A real notice states which addresses are entering the pool, which are leaving, when the overlap ends, and nothing else. It carries a timestamp inside the signed text. It does not explain itself at length, does not apologise, and does not tell you to hurry.
It also does not appear first on a forum. It appears at the current addresses, signed, and reaches everywhere else by being copied. A copy is fine, since the signature travels with the text, but where you found it contributes nothing to whether it is real.
Six tells
- A deadline. Migrate within twenty four hours, act now, old addresses die tonight. Real rotations run long overlaps so that nobody has to hurry. A clock is manipulation, not scheduling.
- An address and nothing else. The whole message exists to move you somewhere. Genuine notices describe a situation, forgeries route traffic.
- An excuse for a missing signature. Key rotated, forum stripped it, posting from mobile, will sign later. All the same lie, and the more elaborate the excuse the more effort went into the rest of the scam.
- Anything touching credentials. Log in to confirm the migration, re enter your seed. Announcements inform. They never ask.
- Perfect timing with an outage. A helpful new address surfacing while the real ones are unreachable is the plan, not a coincidence.
- Emotional register. Real operational writing is flat. Anything written to make you feel urgency is doing a job other than informing you.
Why outages are the window
Because the check people would normally run is unavailable. Ordinarily you could compare a claimed new address against the working ones, or just go to the site and see. During an outage neither is possible, the reader is anxious, and a forum post offering a way in looks like help. Every property that makes an outage frustrating also makes it the ideal moment to seed a fake.
Which gives a simple rule. An address that first appears to you during an outage deserves more scepticism than one that appears during normal operation, not less. Whatever is unreachable will come back, and waiting costs nothing except patience.
The check, in full
Copy the entire signed block, armour lines included, without trimming or reformatting. Verify against your pinned fingerprint rather than any key offered alongside. Read both the key ID and the timestamp in the output. If it verifies against your fingerprint with a recent date it is genuine, and if any part of that fails it is not, regardless of how reasonable the surrounding text sounds.
Verified working Nexus Market mirrors
Three v3 onion addresses currently serving the production market, signed under PGP fingerprint 0x7F2A0A9D. Use the Copy buttons.