A phishing mirror is a business#
Most advice about onion phishing tells you what to do. Check the address, use bookmarks, be careful. That advice is correct, but it’s much easier to follow once you understand what you’re up against. So this guide does something different. It follows a phishing mirror from the other side, the way the people who build them do.
The important thing to grasp is that onion phishing isn’t a joke or a one-off. It’s a business with a production line, and it has been running for more than ten years. Back in 2015, the founder of the Ahmia onion search engine warned the Tor community that at least 255 fake onion sites had been set up, copying well-known services. In September 2026, security researchers found a control panel being offered as a product, designed to run several phishing onions at once, collect logins, swap payment details and even take over accounts automatically.
Between those two dates, the tools improved but the method stayed almost exactly the same. It has four steps.
- Forge an address that looks like the genuine one at first glance.
- Proxy the real site, so the fake looks and behaves exactly like the original.
- Swap a few small things on the way through, such as payment addresses and login forms.
- Get people to visit, through link lists, forums, search results and messages.
Each step has a weak point, and each weak point is something you can use against it. We’ll go through the steps in order, then look at where the chain breaks. If you’d like the short practical version first, see our guide How to Verify an Onion Address Is Official.
Step one: forging a lookalike address#
Nobody can choose an onion address. An address is derived from a cryptographic key, so the only way to get one is to generate a key and see what comes out. But you can generate a large number of keys very quickly and keep only the ones whose addresses begin the way you want. That’s the whole trick.
It isn’t new and it isn’t secret. Organisations use it legitimately to get readable addresses. DuckDuckGo’s onion begins with duckduckgo and the BBC’s with bbcweb3 for exactly that reason, and the Tor Project even publishes a tool for it called Onionmine. Scammers use the same technique to make their address start the same way as the real one.
What it looked like in 2015#
When onion addresses were only 16 characters long, the 2015 warning on the Tor mailing list gave a clear example. At the time, DuckDuckGo’s onion began with 3g2upl4, while the fake one began with 3g2up and then went its own way. Five matching characters were enough to pass a quick glance. Both of those addresses are long dead, since every 16-character address stopped working in 2021, but the habit they exploited is still with us.
What it looks like now#
Modern addresses are 56 characters long, which makes clones look even more convincing, not less. Nobody can hold 56 random characters in their head, so people check the start and assume the rest. Each extra character a scammer wants to match makes the search about 32 times longer, and matching eight characters takes hours to days on ordinary hardware, which is plenty.
The September 2026 phishing panel shows how routine this has become. It came with a built-in address generator. The operator typed in a prefix, chose how many addresses and processing threads they wanted, and the panel produced lookalikes on demand while showing CPU and memory use, like any other piece of server software.
What a forger can’t do#
There are hard limits, and they’re your advantage.
- They can’t match the whole address. That would mean recreating the real organisation’s private key. It isn’t a question of patience or money. It can’t be done.
- They mostly control the beginning. Matching characters at the start is the efficient way to search, so the middle and end of a clone are almost always different from the original.
- The ending is fixed for everyone. Every valid modern address ends in the letter d, real or fake, so the last character tells you nothing about which one you have.
That’s why the middle of an address is where clones give themselves away, and why comparing the whole string with a computer beats reading it by eye. When researchers studied how Tor users look up onion addresses in 2018, they found that for 16 of the 20 most-visited onions in their data, people had also looked up a different address that was extremely similar. Lookalikes get visited.
Step two: the proxy#
If you imagine a phishing site as a static copy of a login page, you’ll expect it to look slightly wrong, with old content, broken links or a design that’s a little off. Good onion clones aren’t like that, because they aren’t copies at all. They’re proxies.
A proxy sits between you and the real website. When you open the fake address, the clone’s server opens the real site in the background, fetches the page you asked for and passes it on to you. When you click a link, it fetches that page too. When you log in, it sends your username and password to the real site and passes back whatever the real site replies. To you, everything works, because everything you see is the real site, live, a fraction of a second late.
Why that’s so convincing#
The 2015 warning described the clones as transparent proxies of the real sites, only slightly slower and hard to tell apart, with nothing unusual even in the technical details a careful user might inspect. Eleven years later, the September 2026 report found the same thing. The cloned sites reproduced the originals’ layout and posts so closely that the researchers called them difficult to tell apart visually.
The most striking detail from 2026 is this. One of the real sites showed users a warning about phishing clones after they logged in. The clone showed exactly the same warning. It wasn’t trying to. It simply passed on whatever the real site said, including the advice to watch out for sites like itself.
That’s the lesson worth keeping. On a proxied clone, nothing you can see on the page tells you whether it’s real. Not the design, not the content, not the warnings, and not the fact that your login worked. The only things a proxy can’t fake are the ones that don’t come from the page.
What a proxy can’t fake#
- The address in your address bar. The proxy serves real content from a different address. Comparing that address properly is still the most reliable test, as our guide How to Verify an Onion Address Is Official explains.
- A certificate for the real onion. Several organisations, including DuckDuckGo, Brave, the BBC, Proton and Cloudflare, serve their onions with a certificate issued to the real onion address. A clone can’t get a valid certificate for that address, so it either shows a warning or falls back to plain http://. Either is a red flag.
- Your bookmark. If you always arrive through a bookmark you made from a trusted source, the proxy never gets its chance.
Where proxies stumble#
Proxies aren’t perfect, and sometimes the seams show. In the 2026 report, one clone’s login check failed where the real site’s worked, and another clone showed a verification image in which the site’s own address appeared cut short. A few sites deliberately display their real address inside an image, which a proxy can’t easily rewrite. If a site you use does this, look at it every time. But don’t rely on glitches. A well-run proxy may have none at all.
Step three: the swap#
A proxy that only passed pages through would be pointless. Its whole purpose is to make a few small changes as the pages pass through, changes you’re unlikely to notice because everything else is perfect. Year after year, those changes have followed a very consistent pattern.
Payment addresses#
This is the oldest and most profitable trick. When a page shows a cryptocurrency address to pay into, the proxy replaces it with the scammer’s own. You pay, the money goes to them, and the real site never sees it.
The 2015 clones did exactly this, replacing the Bitcoin addresses on the pages they proxied. The September 2026 panel had a dedicated payment menu for it, able to swap both wallet addresses and the QR codes that encode them. The researchers watched it replace a site’s genuine Monero address with the operator’s own on the clone.
The same idea has turned up elsewhere on Tor. In 2020, a researcher known as nusenu documented a group running hundreds of malicious Tor exit relays, at its peak about 23% of the network’s exit capacity. The group quietly downgraded connections to Bitcoin mixing services on the normal web from HTTPS to plain HTTP, so it could swap Bitcoin addresses as the pages passed through. That attack worked on ordinary websites, not onions, because onion connections never pass through an exit relay at all. But it shows how valuable a single swapped address can be to the people doing it.
Links#
A clone also rewrites the links on the page, so that clicking around keeps you inside the trap. A link to another service may take you to that service’s clone instead. The 2015 report noted that the attacker was replacing links as well as payment addresses.
Logins and secrets#
When you log in through a proxy, your username and password pass straight through the scammer’s server, and they keep a copy. The 2026 panel stored every login in a table that could be exported as a spreadsheet, with about 960 account entries across its sites. Depending on the site, it also collected PGP keys and cryptocurrency details. One clone was set up to ask users for their wallet recovery phrase when they logged in, something no genuine site would ever request.
Taking over the account#
The newest development is automation. The 2026 panel sent the operator instant messages on Telegram whenever someone registered, logged in or placed an order. It also had a feature that automatically changed a victim’s password once their account balance passed a set threshold, locking them out while the operator emptied it. The researchers said it looked like a maintained product sold as a service, not a one-off kit.
Not just money#
Most documented cases involve money, because that’s where the profit is. But the same machinery works on anything you type or download. A clone of a webmail service collects passwords, which is why our guide to Secure Email Over Tor tells you to log in only from a bookmark. A 2021 academic paper on phishing detection noted that a clone of a newsroom’s SecureDrop could capture the codenames sources use to check for replies, which matters for anyone reading our page on news onion sites. And a proxy could just as easily swap a software download link for a modified installer, which is why signatures still matter even when you download over an onion, as we explain in Open-Source Projects on Onion.
Step four: getting people to visit#
A clone is worthless if nobody finds it. The final step, and the one where scammers spend most of their effort, is putting the fake address where people will pick it up. The channels are always the ones that offer no proof of where an address came from.
Link lists#
The long “hidden wiki” style directories are the classic channel. Anyone can set one up, nobody checks them, and a clone’s address looks just as legitimate as the real one in a list. The scale of the problem showed up in an unexpected place. When law enforcement seized hundreds of onion sites during Operation Onymous in 2014, an independent analysis of the seized addresses it could identify found that more than half were clones, scams or phishing sites. We explain how these lists go wrong in Why Most ‘Hidden Wiki’ Lists Are Full of Scams.
Search tools#
Third-party onion search engines index whatever they find, clones included, and their rankings are easy to manipulate. A clone only has to appear above the real site once to catch someone. That’s one reason our directory lists only the official onions of established search companies, as we explain in Search Engines With Official Onion Sites.
Forums, comments and messages#
A post in a forum thread saying “here’s the new mirror”, a comment under an article, or a direct message from a helpful stranger is the cheapest distribution channel there is. These tend to appear exactly when people are looking for help, which brings us to the most effective moment of all.
When the real site is down#
Clones do their best business when the official onion isn’t working. People who can’t reach a service go looking for another address, and the first one they find is often a fake. Outages happen for ordinary reasons, and sometimes for deliberate ones. In September 2026, the Tor Project’s emergency release fixed, among other things, a flaw that could let an attacker flood an onion service with connection attempts and knock it offline, as we explain in Tor’s September 2026 security fixes. Whatever the cause, the rule is the same. If the official onion is down, wait, or go back to the organisation’s own website. A working address from a stranger is not a substitute.
Your own address bar#
The last channel is one people rarely think of. If you once landed on a clone, Tor Browser’s address bar can suggest its address again later in the same session as you start typing. And a clone you bookmarked by mistake will keep sending you back to it. A wrong bookmark is worse than none at all, so check your bookmarks once against a trusted source.
Fake apps and fake downloads#
Some scams skip the onion entirely and hand you a fake “Tor browser” or “dark web app” that sends you to clones by design. We track these in Fake ‘Dark Web’ Apps in 2026, and the fix is to get Tor Browser only from the Tor Project, as described in How to Download and Install Tor Browser Safely. On a phone, our guide to using Tor on Android and iPhone lists the genuine apps.
Where the chain breaks#
Every step on the production line depends on something you do. Change that one habit and the step fails, however good the clone is.
| Step | What the scammer relies on | How you break it |
|---|---|---|
| Forging the address | You’ll check the first few characters and assume the rest | Compare all 56 characters, ideally with a text editor’s search rather than your eyes |
| The proxy | You’ll judge the site by how it looks and whether your login works | Judge by the address, the certificate and your bookmark, never by the page |
| The swap | You’ll trust a payment address or login form because it’s on the page | Never enter secrets or send money on a site you reached by an unproven route |
| Distribution | You’ll take an address from wherever you found it | Get addresses only from the organisation itself, then bookmark them |
The habits that matter most#
Get the address from the top. Use the organisation’s own website, its Onion-Location button, or a certificate issued to its onion. Our guide How to Verify an Onion Address Is Official ranks the common sources from most reliable to worthless, and our Official Onion Mirrors Directory shows the proof for every address it lists.
Bookmark once, then never search again. A bookmark made from a trusted source defeats every distribution channel above in one go. It’s by far the most effective habit there is.
Let the computer compare. Paste the address you have and the trusted one into a text editor and search for one inside the other. It takes ten seconds, and it never gets tired or hopeful.
Treat payment details as suspicious by default. Payment addresses and QR codes are the first things a clone swaps. If you have to send money, check the address through a second route the clone can’t touch, and be wary of any site that asks for your wallet’s recovery phrase. No genuine site needs it.
Use two-factor authentication. It can’t stop a proxy that relays your code in real time, but it does stop a scammer from simply reusing a password they collected later. Pair it with a unique password for every account.
When a site is down, wait. Don’t go hunting for an alternative address, because that’s exactly the moment clones are waiting for.
If you run an onion service#
Organisations can make cloning much less effective too. Publish your onion address on your own website, ideally on a dedicated page. Add Onion-Location so Tor Browser users are pointed to the real address automatically. If you can, serve the onion over HTTPS with a certificate issued to it, which no clone can copy. Some sites also show their own address inside an image, which proxies find hard to rewrite. Our guide How to Host Your Own Onion Service covers each of these.
If you’ve been caught#
It happens to careful people, because good clones are built to fool careful people. Close the tab, use New Identity, and change your password on the real service through a trusted route. Then turn on two-factor authentication and check your account’s recent activity. The full step-by-step list is in our verification guide. If the clone was impersonating a service in our directory, report it to us with the full address so we can warn other readers.
Where to go next#
- Want the step-by-step checklist? Read How to Verify an Onion Address Is Official.
- Want addresses that have already been checked? Use the Official Onion Mirrors Directory, including the Tor Project’s own official onion sites.
- Wondering why link lists are so risky? See Why Most ‘Hidden Wiki’ Lists Are Full of Scams.
- Using webmail over Tor? Read Secure Email Over Tor: Proton Mail and Riseup Onions.
- Want to understand why addresses look the way they do? See What Is an Onion Service? .onion Addresses Explained.
- Want to limit what a malicious page can do to your browser? See Tor Browser Security Levels: Standard vs Safer vs Safest.
- New here? Find out how we choose what to list in About thehidden.wiki.
6 comments