The signed list and the captcha check.
Two checks confirm a genuine Crown address.
The login prints the market address near the captcha. Compare it to your bar. A clone can copy Crown's clean theme, but it cannot easily serve the correct address in the captcha while pointing you elsewhere. Run this every session.
Crown signs its mirror rotation with a PGP key. It also turns PGP on vendor messages on by default, which removes a class of mistakes where a buyer pastes an address into a message they thought was encrypted and it was not.
Crown Market