Anubis Market: onion address and mirrors

Opening Anubis Market

Start with Tor Browser, because a .onion host will not resolve in an ordinary browser, and a clearnet gateway that translates the address puts a reader between you and the market. The browser comes from torproject.org/download, and the security level stays at Standard.

From the mirror board above, click the copy button next to any one of the three addresses. Copying matters, because a hand-typed string of 56 characters almost always loses one character somewhere, and a single changed character is a different site. Paste the string into the address bar and press enter.

What happens next is the circuit building, and a fresh v3 circuit takes anywhere from ten to sixty seconds, sometimes closer to two minutes on a slow network. During that window a blank page is expected, not a sign of a dead address, and a connection reset while the address is still resolving is normal behavior for a v3 service. Give it the time, reload once, and if the storefront lands, the market is open in front of you.

What to check when you arrive

Until the checks below come back clean, the page is an assertion rather than a fact, and the checks are worth doing before the login and long before the wallet page.

• The address in the bar. Read the string exactly as it sits there. A v3 onion is 56 characters of base32 before the .onion, drawn from the letters a to z and the digits 2 to 7, so a zero or a one cannot appear. If the length is off or a 0 or 1 is hiding in the string, the page is not Anubis.
• The branding. Compare the logo, the name, and the layout against what the real storefront looks like. A typosquat copies the design and moves a single element, and the typosquat block above lists those one-character variants. If the page in front of you matches a variant rather than the real address, you are standing on the copy.
• The PGP fingerprint. Anubis publishes its public key on the site, usually in the about section or the footer. Read it there and line it up, character by character, against the fingerprint in the panel above. A match ties the key on the page to the key that signs the releases. A mismatch is a different key held by someone who wants it to look close enough to pass a glance.
• An admin release. When an address rotates, the new one arrives in a PGP-signed release rather than in a comment or a direct message. The release can be checked against the fingerprint, so the address and the key confirm each other. An address that came from anywhere else is still a claim, not a fact.

Logging in

The account needs two things kept out of reach of everything else: an email created for this market alone, and a password that has never existed anywhere before. Generate the password, store it, and let the market be the only place it works. A later leak then has a single destination and no second one.

The login form has one legitimate position. It is the market's own page, loaded after the storefront, reached from the store's navigation. A password field that appears before you have seen the store is not Anubis asking for anything. Close the tab, go back to the board above, and open the address again.

The four-coin question

Anubis is the only market in the list that takes ETH, and that makes it the answer to one specific question: where does an Ethereum balance get spent? If you hold ETH and want to use it on a darknet market, Anubis is the row in the comparison table that fits. For a buyer holding nothing but Monero or Bitcoin, the ETH column is a non-issue, and the market behaves like the others.

ETH is the odd one out in the list of four, because it is the coin that is not private. An Ethereum payment sits on a public chain. The wallet address, the amount sent, the time, all of it is readable by anyone who looks at the ledger. The address you pay from is tied to the transaction, and the transaction is tied to the market's deposit address, and a chain of those can link a buyer to a purchase. Monero does not do that. An XMR payment does not put the amount or the parties on a public record, which is why XMR stays the private option even on a market that also takes ETH.

Who pays in ETH is the person who already holds it and would otherwise have to swap it to spend it, or who is comfortable with the public record. The network fee is the other variable. Ethereum gas changes with congestion, and a fee that is trivial one hour can be a real share of a small order the next. Check the fee before you build the payment, because the fee is yours to pay on top of the price, and it is the one number on the page that moves without notice.

If the address does not open

The circuit gets its full minute before the first judgment, and one reload comes after. If the address still will not open, the next one from the board is the move: three equal strings, one market, a different path to the same storefront. If all three refuse, the block is on the network side. Some providers throttle Tor traffic, and bridge mode in the Tor Browser settings routes around it. The step-by-step version is in the access guide.

Three equal addresses, one fingerprint, and one coin that only this market takes. The ETH option is real, and so is the public chain it runs on. Know which of the four you are paying in before you pay at all.