Founder of the ahmia.fi project reports that someone is cloning and booby trapping hundreds of Dark Web sites and is re-writing some of the content. These sites are actually working as a transparent proxy to real sites, but the attacker works as MITM and rewrites some content. It is possible that the attacker is gathering information, including user names and passwords. The attacker is running multiple onion addresses similar to the popular onion addresses. There are at least 255 fake mirror sites, including the popular search engine DuckDuckGo.”]
Source: http://securityaffairs.co/wordpress/38253/cyber-crime/hundreds-fake-dark-web-sites.html