Torzon market verified mirror list
Five onion addresses. All PGP-signed. All checked within the last 48 hours. This page exists because phishing clones of Torzon outnumber the real addresses three to one in search results. Copy from here, not from a Telegram bot, not from a forum thread you found today.
Loading...
Why Torzon runs five mirrors, not one
A single hidden service address is a single point of failure. Five parallel addresses spread the attack surface so thin that targeted downtime becomes a temporary inconvenience rather than a market stoppage.
The January 2026 DDoS campaign explains everything
In early January 2026, a coordinated DDoS campaign hit all five Torzon mirrors inside a seven-day window. The primary address went unreachable for eleven hours on the worst day. Because four other addresses existed, the marketplace never fully went down. Buyers switched addresses, orders continued processing, and no escrow funds were delayed. Total downtime for the month: under four hours per user if they rotated correctly.
A single-address market would have been dark for eleven hours that Tuesday. The five-mirror structure is not redundancy theatre — it is the actual defense mechanism that kept 57,971 accounts operational through the worst attack Torzon has faced since launch.
For context on how Tor hidden service redundancy works technically, the Tor Project documentation and the privacy research published by EFF both cover multi-address service design in their onion service guides.
How mirror rotation works
Torzon does not retire mirrors on a schedule. Rotation happens in response to events: sustained DDoS above a threshold, circuit-level blocking by an ISP operating a Tor exit cluster, or an address that starts resolving incorrectly due to Tor network instability. When a mirror is retired, the PGP-signed announcement on Dread is updated within twelve hours and this page refreshes within the 48-hour verification cycle.
The average Torzon mirror lifespan has been 68 days since the Q2 2024 network upgrade that introduced the fifth address. Shorter lifespans happen after DDoS campaigns. Longer lifespans happen during quiet periods — the primary address has been continuous since August 2025.
For independent reading on how DDoS defenses work at the Tor protocol level, Whonix's documentation and the OnionShare project both publish accessible technical summaries.
What "verified" actually means here
Every address on this page has been checked against the PGP-signed list in the current Torzon Dread announcement. The signature is validated using the Torzon public key that has been stable on Dread since October 2022. Any address that does not appear in that signed post does not appear on this page.
The canary check runs separately. If the canary is older than 96 hours or the signature fails, the mirrors section carries a warning regardless of whether the addresses still resolve. An address can be technically reachable and still unsafe — a seized server would respond normally until the seizure became public.
"The canary is the first thing to check, not the last."
— Dread security thread, March 2026
All five verified Torzon market onion addresses
Last verification: April 21, 2026. PGP-signed against the current Dread superlist entry. Refresh this page before every session — addresses rotate after major DDoS events.
Loading...
Loading...
Loading...
Loading...
Loading...
Every string above is 56 characters. A shorter address means the browser truncated it — refresh and copy again. To independently verify, fetch the Torzon PGP public key from the pinned Dread announcement and check the signature against this list.
Mirror verification checklist
- Length. Count the characters. Genuine Torzon addresses are exactly 56 characters, lowercase alphanumeric only, ending in .onion.
- No JavaScript requirement. The real Torzon login page renders with scripts disabled. A splash page demanding JS is a phishing clone.
- Canary freshness. The PGP canary should be under 96 hours old. Check the timestamp before entering credentials.
- Source. You copied the address from a PGP-signed source — this page or the Dread announcement directly. An address from Telegram or a Reddit post has not been verified.
- No unusual characters. Genuine onion addresses contain only lowercase a–z and 2–7. Any uppercase letter, hyphen, or symbol in the string is a red flag.
- Captcha on landing. Torzon's anti-bot layer presents a captcha on first load. Missing captcha means missing anti-bot protection — that is not the genuine entry flow.
- No pre-funding request. Real Torzon generates a one-time escrow address per order. Any page asking you to deposit to a wallet before placing an order is not genuine.
- Correct login flow. Genuine Torzon login asks for username, passphrase, and 2FA challenge. A page that skips any of those steps is a stripped-down phishing page.
For an independent reference on identifying phishing hidden services, Privacy Guides and the EFF Surveillance Self-Defense guide both cover .onion verification in their Tor sections.
How to verify a Torzon mirror independently
This page does the verification work for you, but understanding the underlying method helps you spot a compromised directory before it costs anything.
-
1
Locate the signed Torzon announcement on Dread
Dread hosts the Torzon market's official subforum where all mirror announcements are published. The pinned post at the top of the subforum contains the signed mirror list. Navigate to it through Dread's search rather than a direct link — Dread's own address should come from a source you already trust, not from a fresh search result.
Dread is accessible through Tor Browser. Install Tor Browser from torproject.org first if you haven't already.
-
2
Download the Torzon PGP public key
The public key is embedded in the Dread announcement itself. Copy the entire block between the -----BEGIN PGP PUBLIC KEY BLOCK----- and -----END PGP PUBLIC KEY BLOCK----- markers. Import it into GnuPG. The fingerprint should match the one published in the Torzon market's pinned announcement — compare the last eight characters at minimum.
-
3
Copy the signed mirror block
Below the key is the actual signed mirror list, a block starting with -----BEGIN PGP SIGNED MESSAGE----- and ending with -----END PGP SIGNATURE-----. Copy that entire block. This is the document you will verify against the key you just imported.
-
4
Run gpg --verify
Save the signed block to a local text file, then run
gpg --verify filename.txtin a terminal. GnuPG will output "Good signature" if the document is authentic and "BAD signature" or an error if it is not. A bad verification means the document was altered after signing — do not use any address from it.Use Tails OS for this step if you want an air-gapped verification environment. Tails ships with GnuPG pre-installed.
-
5
Compare the verified addresses to what you plan to use
Open the signed text you just verified. Copy each address from it character by character into Tor Browser rather than from the terminal display. Terminal fonts make certain character pairs look identical — l and 1, O and 0, rn and m. The copy-paste step eliminates transcription errors.
Mirror questions — the nine that come up most
Answers to what people ask after they land on this page for the first time.
How many Torzon market mirrors exist in 2026?
Five. All five are authenticated through the PGP-signed announcement on Dread and have been continuously active since the Q2 2024 network upgrade. The fifth address was added specifically after the mirror three DDoS event in March 2024 to give buyers a secondary failover beyond the standard four-address load split.
Why do Torzon market mirrors rotate?
DDoS campaigns, Tor network instability, and exit-node blocking can all push an address into semi-permanent unresponsiveness. Rotating the address is faster than fighting the specific attack pattern. The average mirror lifespan since Q2 2024 has been 68 days. The primary address is an outlier — unchanged since August 2025.
How do I verify a Torzon onion link is genuine?
Three quick checks before pasting any address. First, confirm it is 56 characters long. Second, confirm every character is lowercase a–z or 2–7. Third, verify it appears in the current PGP-signed Dread announcement. An address that clears all three checks has an extremely low probability of being a phishing clone.
Can I use all five mirrors with the same account?
Yes. All five addresses route to the same Torzon infrastructure. Account data, escrow balances, open orders, and vendor watchlists are identical regardless of which mirror you connect through. Session tokens also persist — you will not be asked to log in again if you switch addresses mid-session.
What should I do if a Torzon mirror is slow?
Wait thirty seconds, try the next address. Tor circuit latency is the most common cause of slow loads, and it is unrelated to mirror status. If two consecutive addresses are slow, build a new Tor circuit using the "New Identity" option before trying a third. If all five addresses are unreachable, check the Dread forum — the community reports downtime within minutes.
Are Torzon mirror addresses safe to bookmark?
Only inside Tor Browser. An onion address in a regular browser bookmark is accessible to sync services, installed extensions, and any malware watching the browser profile folder. Save all five addresses to Tor Browser's bookmark bar exclusively. For an additional layer, store a copy in a KeePassXC note on a VeraCrypt volume.
How often does this page update its mirror list?
Every 48 hours, checked against the current PGP-signed Dread announcement. If a mirror is retired or a new one added, this page reflects the change within that window. The date in the page header shows the last verification timestamp. If that date is more than 72 hours old, close and reload the page before copying any address.
Do Torzon mirrors differ in speed or reliability?
Minor variance. The primary address has the most optimised routing and handles the largest traffic share. European mirrors have lower round-trip times for users in CET and WET zones. The North America mirror handles EST and PST load with lower variance. All five are equally verified and equally safe — choose based on latency, not trust hierarchy.
What is the Torzon PGP canary and how does it relate to mirrors?
The canary is a PGP-signed statement published every 72 hours confirming the operators are free and uncompromised. The mirror list is embedded in the same signed post. If the canary goes stale or the signature fails to verify, every address in the accompanying mirror list should be treated as unconfirmed until a fresh canary appears. A reachable address is not the same as a safe address.
Copy the primary link and open Tor
Five verified mirrors. The primary address below has been stable since August 2025. Copy it into Tor Browser, not into any clearnet browser. Bookmark this page inside Tor so you always have a fresh list when mirrors rotate.
Loading...
- PGP-signed
- Dread superlist
- Verified April 2026
- 5 mirrors live