Anyone who has spent some time using Tor has most likely come across the same website listed at three or four different addresses. One of these addresses is genuine whilst the rest could be dead mirrors, harmless duplicates, or traps set up to steal your password, your cryptocurrency, or your identity. It’s not always easy to tell the real one from the rest, and that’s precisely what scammers take advantage of.
This guide outlines how onion phishing works, the warning signs that are worth knowing, and a simple procedure you can adopt each time you open a new link. It has been updated for October 2026, so it also includes a few changes that have taken place this year.
Why onion links are so easy to fake
On the regular web, a domain such as bbc.com is registered with a central system, allowing you to look it up and see who owns it, and before anything loads your browser checks a certificate. Onion addresses work differently.
A modern onion address, known as version 3, consists of 56 characters made up of letters and numbers and is generated from the site’s own cryptographic key. It is not registered by anyone. Neither does anyone approve it. You can’t contact a company to find out who owns it.
What’s interesting is that this design is in fact quite secure; a genuine onion address can’t be stolen or hijacked, and if you have the exact and correct address then you are talking directly to whoever holds that key.
The vulnerability lies with us, since no one remembers 56 random characters; most people just look at the first few letters, perhaps the last few, and then assume that the rest are okay. Scammers are aware of this, which is why they use vanity address generators. These are programs that go through millions of keys until they come across one whose address begins with the same few characters as a well known site. It doesn’t take a supercomputer to match the first six or seven characters; a normal computer can do it.
Once that has been done, the rest is simple: they copy the pages of the actual website, replace the original login form or payment information with their own, and then spread the fake link anywhere and everywhere they can: link directories, forums, paste sites, social media, comment sections, and even messages from hacked accounts.
Researchers have been documenting this for years. Academic studies on onion phishing showed that many popular services had numerous clones, and that more careful attackers deliberately picked addresses which looked very similar to the original ones. This situation has not improved in 2026; in fact, it has become cheaper to carry out.
Where fake links usually come from
It helps to know where most fakes are found before we start looking for them.
Hidden Wiki style directories. The Hidden Wiki name has been copied so frequently that there is now no single official version of it. Security writers discussing the subject as recently as August 2026 noted that clones of the directory are one of the main reasons people end up on phishing pages. Many of these directories are only very loosely moderated, and some are operated by the same people who run the fake sites. A list containing hundreds of links and no clear owner is a common source of bad addresses.
Onion search engines. These search tools index any sites they come across, including clones. Just because a site appears at the top of the results does not mean that it is genuine.
Paste sites and random forum posts. One of the oldest tricks is to say “Here’s the new working link”. If someone you don’t know is giving out an address, ask yourself why.
Messages from people you know. Accounts can be compromised. Even if a link comes from a trusted contact, it might still be a clone if another person now controls that account.
Clearnet “best onion sites” lists. Many of these lists were created mainly to rank well in Google rather than to protect their readers. A number of them still give old 16 character addresses that stopped working years ago, and no one verifies whether the newer links are genuine.
Red flags in the address itself
It is impossible to verify an onion address merely by looking at it, but you can detect a rather large number of fakes using a few simple checks.
It has only 16 characters. That makes it an old version 2 address. Tor stopped supporting these addresses back in 2021, which means that any 16 character link today is either no longer active or was copied from an outdated list. Treat it as a warning about the source you obtained it from.
The opening matches but the rest doesn’t. This is the well known vanity address trick. Don’t just look at the first word you recognise; check the middle and the end too.
It has a 0, 1, 8 or 9 in it. Onion addresses use only the letters a to z and the digits 2 to 7; that is simply how the encoding works. If you come across a zero, a one, an eight or a nine anywhere in the address, it isn’t a valid onion address at all. Someone made it up or typed it incorrectly.
It doesn’t end with a “d” before “.onion”. All valid version 3 addresses have a “d” immediately before the dot. Although it’s a small point, it quickly catches sloppy fake addresses and typos.
It has extra bits attached. Be careful about things such as .onion.ly, .onion.to, or .onion.ws, since those are clearnet gateways and not actual onion sites. The gateway sits in the middle and is therefore able to see or alter everything you type. You may also come across ordinary websites that include an onion address as part of their domain name in order to appear more official. If the address doesn’t end with plain .onion, then you’re not on Tor’s network for that site.
Red flags on the page
Even if the address has passed those checks, you haven’t finished yet. A good clone can look pixel perfect, so you need to check how the site behaves.
It asks for your login details before displaying anything. While some genuine websites do this, a fraudulent one almost always will, since gathering passwords is the whole point.
It requests things a genuine service would never ask for. Your wallet seed phrase, your private key, your PGP private key, or a “verification deposit” before allowing you to use your account. An honest service never needs your seed phrase at any time.
The payment details are different. A typical trick is to leave the entire site as it is and simply replace the deposit addresses. If you’ve used the service before and find that the payment address has suddenly changed without any notice, then stop.
There is a feeling of urgency. Banners such as “Our main address is under attack, please use this mirror” or “Your account will be deleted in 24 hours” are intended to hurry you. Genuine services usually don’t operate like that, and when they do decide to move, they announce it via channels that you can check.
Links quietly point somewhere else. Lazy clones frequently leave some internal links pointing back to the actual site or to pages that don’t exist. Hover over a few of the links and check where they lead.
It asks you to download software. A “required security plugin”, an “updated Tor client”, or a browser extension. Tor Browser never requires a plugin from a website. This is one of the most dangerous signs, since it shifts the attack from your password to your entire device.
It urges you to lower your security settings. If a page asks you to switch Tor Browser from Safest to Standard, or to turn on a feature that it had previously disabled, you should be highly suspicious.
Another point worth making clearly is that spelling errors are no longer a reliable indicator. In 2026, phishing kits and AI generated text have made cloned pages look polished. Brand protection companies writing about website spoofing this month have observed that generative AI and automated cloning tools have made it faster and cheaper to create fake sites than ever before. Correct grammar means nothing anymore; what matters is the address and the behaviour.
How to verify an onion address properly
This is the section that actually protects you, and it’s not at all complicated.
1. Obtain the address from the organisation’s own website
A large number of legitimate services list their onion address on their regular websites. For example, BBC News, The New York Times, ProPublica, DuckDuckGo, Proton Mail and Riseup all do so. Simply type the standard address in yourself (make sure you don’t click on a search ad), locate the official onion link there and use it. This is by far the most reliable method.
2. Use the “.onion available” button in Tor Browser
If a website supports this feature, Tor Browser displays a small purple “.onion available” label in the address bar. If you click on it, you will be taken to the actual onion site, since the website itself has told your browser where to find it. Alternatively, you can turn on the option that makes the browser prefer onion addresses when it knows them; this setting is located in the Privacy and Security part of Tor Browser’s settings.
3. Check signed mirror lists
Certain services offer a list of their official addresses that is signed using their PGP key. If you have their true public key (preferably obtained once from a source that you trust), then you can verify the signature yourself. A signed list that verifies correctly is strong evidence. A list that is not signed and is posted by “admin” on a random forum is not.
4. Look for an HTTPS certificate
A few onion sites also use HTTPS with a certificate that names the organisation. Certificate authorities are permitted to issue such certificates for onion addresses, and if you come across one, it gives an additional level of confidence that you’re on the correct site. Since the majority of onion sites do not have one, its absence should not be a cause for concern; having it is a useful extra.
5. Compare every character
When you are checking an address against a reliable one, you should compare the entire address. One simple way is to divide it into parts of eight characters and then check each part. Alternatively, you can paste the two versions into a text editor with one on top of the other and look for anything that doesn’t align.
6. Bookmark it once and never search again
When you’ve verified an address, save it as a bookmark in Tor Browser and then use that bookmark. The majority of people who fall for phishing attacks weren’t careless the first time; they were careless each time they looked for the link again.
What’s new in 2026 that matters
A few things have happened this year that are worth knowing about, either because they affect your safety directly or because fraudsters are exploiting them.
Keep Tor Browser updated. A recent stable version is Tor Browser 15.0.21, released on 1 September 2026. An alpha version, 16.0a13, was released on 1 October and included Firefox security updates and fixes relating to onion sites. The Tor Project makes it clear that alpha versions are intended for testers and not for people who need anonymity, so use the stable version from the official download page unless you know what you’re doing. Staying up to date matters, since some phishing pages are paired with exploits that only work on outdated software.
Tor 0.4.8 is being retired. The Tor Project asked all users to upgrade to the 0.4.9 series by September 2026, and the most recent version, 0.4.9.12, was released on 8 September. Those who use standalone Tor or an application that includes it should make sure their version is current.
Fake apps fill the gaps. According to the Tor Project’s support report for July 2026, Orbot for Android is no longer available on the Google Play Store in India. Each time an official app is removed from a store, fake versions appear to take its place. Only download Tor software from the official Tor Project website or from official app repositories, and check the signature if you are able to.
Tails keeps moving. Tails 7.14 came out on 30 September 2026. If you’re concerned about malware from a bad download, Tails is worth considering, since it starts afresh each time you boot it.
The network is becoming stronger behind the scenes. The Tor Project is introducing a new cryptographic defence called Counter Galois Onion, which is also being applied to onion services, and its Rust version of Tor, known as Arti, has gone well beyond being a research project (Arti 2.7.0 was released on 1 October). This does represent real progress. However, let me be honest: none of these measures prevent phishing. Better encryption protects the connection to whatever address you type. It can’t tell you that you’ve typed the wrong one.
Clone economies around defunct brands. Whenever a well known service is shut down or seized, copies using its name continue to appear for years. If a popular website goes offline and then suddenly reappears at a new address, treat it as fake until it has been proven genuine.
A quick checklist before you trust any onion link
- Is it 56 characters long, and does it end with “d.onion”?
- Is it made up solely of the letters a to z and the digits 2 to 7?
- Did you obtain it from the organisation’s own website, the “.onion available” button, or a signed list?
- Does it match your trusted copy character for character?
- Is the page requesting anything unusual, such as a seed phrase, a download, or reduced security settings?
- Is anything pushing you to act quickly?
- Have you bookmarked it so that you’ll never need to search for it again?
If you aren’t able to give a confident yes to the first four questions, then don’t log in and don’t send anything.
What to do if you think you’ve been phished
It can happen to careful people too. If something felt wrong after you’d already entered your details, act quickly.
Stop and close the tab. Don’t type anything else and don’t “test” whether it works.
Change your password using a verified address. Instead of using the link that tricked you, use a bookmark or an address that you have already confirmed. If the service provides it, enable two factor authentication.
Change any reused passwords. If that password was used on any other site, you must also change it there. Attackers try stolen credentials on other websites almost immediately.
Accept that sent crypto is usually lost. Although it’s painful, trying to recover it often makes the situation worse. Don’t fall for anyone who offers to recover your funds for a fee; recovery services are one of the most common follow up scams aimed at people who have just been phished.
Take downloads seriously. If you have installed anything offered by the fake site, your device may be compromised. At least run a reliable scan, and if sensitive data is involved, a fresh installation is the more prudent option.
Warn others. Let the real service know, and report the fake link to whatever directory or forum you found it on. It might save the next person.
Final thoughts
Onion addresses are actually one of the most secure naming systems on the internet. The math is solid. The trouble is that people trust lists, search results and strangers instead of checking the address against a source they can verify.
The habits that keep you safe are boring, and that’s a good thing. Get addresses from official sources. Compare the full string. Bookmark what you’ve verified. Be suspicious of anything that asks for your seed phrase, a download, or a quick decision. Do that consistently and you’ll avoid the vast majority of phishing on Tor.
And if a link ever feels off, trust that feeling. Closing a tab costs you nothing.