Onion Phishing Protection and Address Checks

HTML, stylesheets and images are easy to copy. A phishing operator can reproduce a login flow and generate many onion-service keys until one address begins with a chosen vanity prefix. Reading only the first characters rewards that attack.

The Tor Project onion-services overview explains that a v3 address is derived from public-key material. The full address matters; a brand-like prefix is merely a generated coincidence.

1. Use an address source preserved before the current session or obtained through an independently trusted channel.
2. Compare all 56 characters before .onion. Break the string into groups if that reduces visual errors.
3. Check for substitutions in the middle and end, not only the prefix.
4. Keep the address inert. A copy button or QR code can hide what a script actually places in the clipboard or target.

The TRZN Watch address page maintains the three-address TorZon set used on this site. Match the full string there, then apply signature checks when a signed source is available.

A valid OpenPGP signature shows that the exact signed bytes were produced by the corresponding private key. Use local software such as GnuPG; do not send the message or private material to an online checker.

Fingerprint provenance remains the hard part. If the public key, fingerprint and signed message all came from the suspected site, the attacker controls the complete evidence set. Compare the full fingerprint with a previously trusted or independent source, then confirm that the signed text names the expected address and an appropriate date. The PGP verification guide provides the full workflow.

Operation Bayonet is the clearest public warning. The US Department of Justice account describes Dutch law enforcement covertly operating Hansa after takeover. Users could reach a working service while control had changed.

Keep observations separate: Tor connected, onion service answered, content matched the expected brand, signature was valid, and fingerprint was trusted. Authentic TorZon captures on TRZN Watch document real interface presentation; they still sit beside the full-address check on the address page.

• Do not enter credentials, recovery data, private keys or payment information.
• Close the session and restart from the trusted address and fingerprint records.
• Do not search for a replacement and trust the first result merely because the original failed.
• If credentials were already entered, treat them as exposed and rotate them only from a separately verified destination.
• Review the device for clipboard substitution, unexpected extensions and copied files.

Use the OPSEC guide to place these steps inside a wider identity and device compartment.