How the clones are built, and the one habit that stops them
A clone is a copy of the login page served from a different address. The three ways it gets built are the three ways it gets caught, and the habit that stops all of them is the same one every time.
The copy of the page
The most common clone is a straight copy of the login form, served from an address that is close to the real one. The copy is good enough to fool a fast reader, because the reader is looking for the form, not the address. The form does not know which address it is on. The address bar does, and the address bar is the only witness that is always there.
The typosquat
The second is a domain that is one letter off from a name the market has used before. It is not an onion at all, it is a clearnet page that looks like the market’s old site, and it is aimed at the person who typed the name from memory instead of copying it. The cure is the same as the first. Copy the address from a page you trust, and do not retype it.
The habit that stops all three
Read the address bar before the password field, every time. Not after the page loads and the form is waiting, which is when the eye has already decided the page is right. Before, when the bar is still the only thing on the screen. The prefix and the tail are the two parts to read, and the gate page covers the screen that sits in front of the form.