TorZon Market: onion address and mirrors

Opening TorZon Market

Open it in Tor Browser. A .onion host does not resolve in a normal browser, and a clearnet gateway that translates it sits between you and the market and reads the traffic. Get the browser from torproject.org/download and leave the security level at Standard.

Take one of the five addresses from the mirror board above and click its copy button. Any of the five works, and it does not matter which. Do not retype it. 56 characters by hand always loses one, and one wrong character is a different site. Paste it into the address bar and press enter.

The circuit builds from there. A fresh v3 circuit takes ten to sixty seconds, sometimes close to two minutes on a slow network. A blank page in that window is the circuit being built, not a dead address. A connection reset while the address is still resolving is normal for a v3 service. Wait, reload once. If the storefront lands, you are on the market.

What to check when you arrive

The page is a claim until the checks say otherwise. TorZon is the most imitated name in the list, so the checks are not optional here. Run them before the login, before the wallet.

• The address in the bar. Read it back the way you copied it. Exactly 56 characters before the .onion, from the letters a through z and the digits 2 through 7. No zero, no one. A wrong count or a stray 0 or 1 means it is not a v3 onion and it is not TorZon.
• The branding. The logo, the name, the layout. Because TorZon is the name people type from memory, it is the name typosquats aim at. The typosquat block above lists single-character variants that differ from the real addresses by one letter. If what you see matches a variant instead of the real thing, you are standing on the copy.
• The PGP fingerprint. The market posts its public key, usually in the about section or the footer. Read it and line it up against the fingerprint in the panel above, character by character. A match ties the key on the page to the key the market signs its releases with. A mismatch is a different key, a different "market," someone holding a key that looks close enough to pass a glance.
• An admin release. A rotated address arrives in a PGP-signed release, not in a comment or a direct message. The release checks out against the fingerprint, so the address and the key confirm each other. An address that came from anywhere but a signed release is a claim, not a fact.

Logging in

Field note on accounts. The email is one made for TorZon and nothing else, and the password is one that has never been used anywhere before. That is the whole discipline: a leak on TorZon stays on TorZon.

The login screen is the market's own page. It appears after the storefront, from the store's navigation. A password box that is the first thing on screen is a different site doing TorZon's work. Close the tab, back to the board, try again.

Five addresses, one market

Most markets in the list run three mirrors. TorZon runs five, and the extra addresses are not decoration. A market holds several addresses at once for mechanical reasons. It rotates its signing keys, and when it does, the address changes and the old one stops resolving, so it keeps the new ones alive alongside the ones it is phasing out. Traffic matters too. A single address that takes a DDoS or falls on a bad routing path goes dark, and the other addresses keep the market reachable while that one is fixed. Network changes on the Tor side, a moved server, a renewed certificate, all of it pushes a market toward running more entry points than it strictly needs.

The five are not ranked. There is no main address and no fallback, no "first" and "last." Any one of the five is a complete, equal way into the same storefront. When one will not open, you do not try to diagnose it. You take the next one in the list and open it. Copy it, paste it, let the circuit build. The order you try them in does not matter, because they are the same market and the same place. Five addresses is five chances that at least one opens when the others are blocked or slow.

That same size is why the fakes are concentrated here. The most searched brand in the list is the one lookalikes aim at, and a typosquat only needs to get one letter wrong to catch the person who typed the name from memory. The typosquat block above and the verify the address guide exist for exactly this case. If the address you opened is not one of the five on the board, it is not TorZon, no matter how close it looks.

If the address does not open

Wait out the circuit, thirty to sixty seconds, reload once. Still nothing: the next address from the board. Five equal strings point at one market, so the next one is the same place. All five refuse and it is the route, not the market. Providers throttle Tor, and bridge mode under the Tor Browser settings gets around it. The ordered steps are in the access guide.

Five equal addresses, one fingerprint, and the name in the list that gets copied the most. The extra mirrors are a margin of safety, and the checks are how you make sure the margin is yours and not a copy's.