NOOBS GUIDE - How not to get your bitcoin stolen on Empire Market and verify any empire site

Hi guys and gals,

I have made this guide because as some of you have probably experienced before there are tons of phishing sites that are mimicking empire market. Lots of them are very credible but steal your bitcoins. The most convincing phishing sites use a 'man in the middle' attack where it directs traffic to the original empire market site, but changes the bitcoin deposit address. People fall for this because the nature of the attack means that the users individual personal phrase is displayed correctly and everything seems to be normal but when you deposit, the coins disappear. This has led many users to falsely blame empire market and assume they are conducting an exit scam which is not true.

Firstly I would like to say to avoid this you must have a critical mindset of every empire market onion url you visit. Even if it has worked several times before. I will detail in this guide how to stop getting your money stolen and this is for educational purposes only. I do not take responsibility for anything you buy on the site. Please let me know if there is anything you would like added to the guide and I will aim to do so. I would also appreciate if everyone could upvote this and if the mods could sticky this so we can get maximum views to stop people getting scammed.

With that out of the way, I am assuming you know how to use PGP. if you don't please research how to do this before you continue, the following links may help you (if there is enough demand I will eventually make a separate tutorial on this):

http://www.bitcoinnotbombs.com/beginners-guide-to-pgp/

https://www.reddit.com/r/SilkRoad/comments/1qh266/guide_pgp_4_n00bz/

The critical requirements you must have before continuing:

• you must have some sort of PGP program, i use GPG4WIN and the GPA tool inside it
• you must have a PGP public key and PGP private key
• you must have Empire Markets official PGP public key imported into your chosen PGP program (i detail how to do this below).

The reason why most people get scammed is because they don't verify their links, and when they have, they use the wrong empire market public PGP key located on the phishing sites. The attackers have set this up to work with their own phishing empire market site. The real empire market PGP key has always been located on dreadditevelidot.onion:

1. Copy dreadditevelidot.onion into Tor
2. on the right hand side of the page you will see a link saying '/d/EmpireMarket' click on it
3. towards the top of the page underneath where it says 'Dread' you should see a button called 'PGP' click on it.
4. Copy the PGP public key into notepad and save it as a .txt or .asc file and import it into your chosen PGP program (i tend to use GPA as part of the GPG4WIN toolkit but others prefer to use kleopatra, each to their own it does the same job)

Once you have this key imported name it something like empire market or whatever you wish, this will be the real key that will tell you if any site you are on is genuine or not. It is published only by the creator of empire market. NEVER and I repeat NEVER use the empire market PGP public key located on any empire market url as this can be faked. Only use the one on dreadditevelidot.onion, I hope that is crystal clear.

Now in general, what you want to do next is:

1. take a link from dark.fail e.g. dkndfkn9gfnf.onion(not real) and add '/safe' to the end of it, or alternatively click on 'verify mirror' once you land on the site.
2. follow the prompts until you see a PGP message displayed for you, copy this into GPA or other program and click 'verify', if all is good you should see a popup saying 'valid signature' and maybe some text highlighted in green. It looks like this:

https://pasteboard.co/IkNVbsC.png

1. If you see anything saying 'bad signature' then under no circumstances login or use the site as it is a phishing site.

https://pasteboard.co/IkNVP1l.png

1. if the signature is good proceed to login

Now, once you are certain the site is real, you still don't want to trust it 100%. What you want to do is go to the bitcoin deposit page and click 'generate a bitcoin deposit address'. Once that is done, underneath you will see a link saying 'Get PGP signed proof of ownership', click that and go through the prompts (as similar to before on /safe) you will see a PGP and you want to verify that also to make sure the signature is valid.

Once you have successful signatures for the previous steps you pretty much have the green light to deposit your bitcoin to that address. However if you are planning on depositing an amount you can't afford to lose, what I would suggest is depositing a small amount first. And if it is successful then you can deposit again later as the site will be confirmed to be genuine. This is an almost fool proof way of ensuring you don't lose your bitcoin if you follow the steps I have mentioned. HOWEVER IT MUST BE STATED THAT EVERY TIME YOU DEPOSIT TO A BITCOIN ADDRESS, YOU HAVE TO GENERATE A NEW BITCOIN ADDRESS AS ANY NEW COINS YOU SEND TO A PREVIOUS ADDRESS WILL BE LOST.

To prevent any further losses to your account you can go into your profile and enable 2FA authentication. This essentially ensures that no one can access your account unless they have your private PGP key and also if the .onion you see in the decrypted message doesn't match the url one you are on, it is a phishing site. If you would like a tutorial on how to do this please request it enough times and I will try to find time to write a tutorial up.

I am writing this from a position of frustration after losing a large amount of money to scammers and hope that my information can help you. Please take the time to follow all the steps meticulously and feel free to comment if you are having trouble. I work full time so I will try to get back to people when I am free. Please excuse any grammar errors as I wrote this in a rush and plan on editing it based on feedback. Happy Shopping

Mods please sticky this, spread the word and lets eliminate the scammers.

EDIT: I have had alot of requests from people who still can't successfully verify the mirror. Please make sure when you solve the captcha on the 'verify mirror' link that you copy the whole txt including the signature and the pgp code before you verify. If you are using dark.fail and it still isn't working then retry the captcha a few times becuase there may be a sync issue on the empire market server. For all the other users who still can't get it to work, for these people I think only a video tutorial would help. Also probably better not to login to any site until you have a firm grip of PGP, how it works and how to use it. As you can understand this would take time and i plan on releasing one on the weekend so please stay patient until i have edited and uploaded one on youtube. To make life easier for people I also plan on uploading empire markets PGP key to a download website, but I am hesitant to do this because I don't want anyone to half follow the instructions and then blame me if they lose their bitcoin.

Guys here is the empire market key that I have on my own computer (use at your own risk, it works for me and other people):

http://www.filedropper.com/empirekey