First contact
Impersonators reach out unprompted, usually right after an outage, offering help or a "private" mirror.
Unsigned links
They share a we the north market url without any signature, or with a signature that does not verify against the known key.
The ask
Sooner or later they ask for your password, PIN, recovery phrase or a payment to "restore" access.
Your response
Do not reply. Check the address only against signed announcements and the status cards here.
Anyone offering a private WeTheNorth link and asking for credentials is an impersonator.