The 5-Minute Emergency Read for a Changed Onion Address
When a saved onion link stops opening, treat it as a dead address until proven otherwise. Understanding how mirrors work helps here: a mirror is a separately hosted copy of the same market interface, but its address can be rotated without notice, so the old link is not simply “temporarily down.” Do not rush to the first search result or social post offering a replacement.
First actions before touching another domain
- Step 1Keep the original tab open; note the exact error text or blank-screen behaviour.
- Step 2Wait 60–120 seconds and retry the same address once over a fresh Tor circuit (new identity).
- Step 3If it still fails, do not search for “new mirror” on clearnet forums, Reddit, or Telegram.
- Step 4Check whether the market itself announced an address change through a channel you already had before the outage.
- Step 5Compare any candidate link against your known PGP-signed source, not against what a stranger posted.
- A mirror is a copy of the market frontend, not a new market
- Address rotation is normal, but that does not make every link safe
- A working-looking login page is not proof of legitimacy
- Bookmark at least two independent, previously verified routes to the site
| What to check | Safe response | Unsafe response |
|---|---|---|
| Saved link opens after retry | continue with normal caution | still replace the bookmark later ;; Trusted channel has no notice |
The moment a link fails, scammers seed “updated mirror” pages that look live but steal credentials. A login page that resembles the market proves only that someone copied the layout.
- Mirror
- a separately hosted copy of the same onion service, meant to keep access alive when one address is blocked or overloaded
- Trusted notice
- a signed message from a source you verified before the outage, not a new account discovered during it
If the market’s real mirror list is signed, use that signature as the filter. No signature on a “backup link” means no connection, no matter how urgent the need feels.
Why Does a Market's Onion Address Change So Often?
A market rotates its onion address because the previous one has become operationally unsafe or overloaded. Infrastructure takedowns, denial-of-service pressure, and crowd distribution are the usual triggers — not a change in the market itself.
Onion addresses are not like domain names. There is no registrar keeping a single name alive. The address is a cryptographic identity tied to a specific server key set. When hosting moves, when a front server is seized, or when a cluster is rebalanced, the old address dies with the old setup.
What this means for your saved bookmarks
- A saved onion link is a snapshot, not a subscription. It reflects one server setup at one moment.
- When the market cycles mirrors, the bookmark you saved last month may point to a dead endpoint or — worse — to a lookalike.
- Treat bookmarks as historical artefacts: useful only if you can re-verify them against the same source that gave you the original link.
Do not reuse an old onion link just because the page still loads. If the market changed addresses, an old link that “still works” can be a phishing clone placed after the original went dark. Verify before you type anything into it.
Crowd distribution matters too. A market may push different mirrors to different regions or user groups to keep one address from becoming a single point of failure. What worked for you on a laptop yesterday may not be the mirror your phone should use today.
If you keep a bookmark list, pair each onion link with the date you verified it and the trusted source that published it. A bare link without provenance is useless after the next rotation.
How Does a Rotating Mirror Actually Work on Different Devices?
A rotating mirror is not one address that changes on a schedule; it is a set of onion endpoints that a market rotates through, often with an entry or redirect page that hands your session to the next working pointer. How that handoff behaves depends on whether your device keeps a long Tor session, caches a landing page, or reloads a bookmarked URL.
Phone: rotation feels faster, cache works against you
On a phone, Tor Browser usually keeps one short-lived circuit per tab. A rotating mirror may open, validate a proof string, then redirect you to a fresh onion within seconds. If the app or a saved page is cached, you can end up on a stale mirror that accepts the old token but no longer loads market data.
- Phone or tabletOpen the mirror link, let the redirect finish once, do not press back or refresh the landing page
- DesktopCopy the final onion after redirect, verify the URL prefix, then use that endpoint for the session
- Repeat sessionsStart from the rotation page again instead of reusing yesterday’s final onion
Treat a redirect as a one-way door: once the market settles on a working onion, use only that address until the session ends.
Tablet and desktop: redirect chains split differently
Desktop Tor often holds a connection longer, so a mirror change can feel delayed: the old tab may sit on a dead page while a fresh tab reaches the new mirror faster. A tablet session may keep app state alive, showing a cached market skin even when the onion behind it no longer answers.
If the page renders but every market action times out, you are probably viewing a cached shell, not a live mirror. Close the tab, reopen the rotation entry, and follow the redirect once.
What Should You Verify Before Connecting to Any Listed Link?
A listed mirror is only as trustworthy as the chain of evidence behind it. Before connecting, match the address against at least one known signature you have independently saved or received through a PGP-signed channel — not a forum post, not a Telegram pin, not a Reddit comment chain.
The pre-connection checklist
- Does the full
.onionstring match exactly, including case and suffix order? - Was the link delivered over a channel that uses signed messages or verified accounts?
- Is the claimed mirror absent from unrelated "top list" pages that bundle multiple markets?
- Have you opened a clean session rather than inheriting cookies or cached redirects from an earlier visit?
- Does the page's first rendered element ask for login before any unusual captcha or "update" prompt?
Compare at least two independent sources that are not linked to each other: a signed vendor note and your own saved index, for example.
A lookalike can differ by one character and still load a full clone of the real market. Visual recognition is never a verification method.
Redirect chains are inherited risk. If a shorter "rotator" link bounces you through three or four intermediate addresses before landing, you are trusting every hop in that chain, not just the final page. A clean mirror should resolve in one direct connection from the address you checked.
Why lookalikes survive
Onion addresses use base32 characters. That visual range is narrow: many letters look similar in lower case, and long strings exhaust attention quickly. Attackers exploit exactly that by registering nearby strings or running pages that imitate the real market's landing layout. The only reliable boundary is cryptographic identity, not screen appearance.
| Check | Clean mirror | Risky copy |
|---|---|---|
| Source | signed message or private index | regular forum comment with no signature ;; Connection |
- Outer check — source that delivered the link
- Middle check — exact address string and absence of redirects
- Inner check — signed identity of the market mirror itself
If you cannot verify the source, treat the mirror as a public test page: open it, read nothing private, enter nothing, and close the session.
The Regular Maintenance Pass: What to Re-Check Every Time
A maintenance pass takes under a minute and boils down to three checks: the link you are holding, the certificate the site presents, and the state of the device you are about to use. If any one of them fails, stop; do not “almost connect” just to see whether the page loads.
Link age and source
- The onion address was copied from a signed or pinned source, not a search result
- The link is less than 72 hours old for a mirror, or matches the market’s current rotation window
- The full v3 address is spell-checked character by character, not trusted from memory
A mirror link is a disposable door. Treat any onion address older than the market’s stated rotation interval as expired, even if it still responds.
Certificate and endpoint check
- The onion self-signed certificate fingerprint is identical to the reference you saved on first contact
- The address bar shows the full
.oniondomain, not an onion-to-web gateway or lookalike host - Browser warning about a mismatch is treated as fatal, not bypassed with “advanced” or “continue anyway”
Local device state
- Tor Browser or the Tor-backed app was restarted before the visit, not left running from yesterday’s session
- Clipboard contains only the onion address, not a string pulled from an unverified chat or image OCR
- No extra tabs, crypto wallets, or logged-in clearnet accounts are open in the same browser profile
The fastest way to inherit a phishing page is to paste a “working” link from an old note into a stale browser session and click through a certificate warning. The maintenance pass exists to break that chain.
- Rotation window
- the period during which a mirror address is expected to be valid before the market shifts to a new one
- Certificate fingerprint
- a short fixed value identifying the onion site’s self-signed certificate, which a phishing clone cannot copy without the private key
- Pinned source
- a saved location, such as a signed list or personal offline note, that you treat as authoritative for new addresses
FAQ
Why did the onion address from my bookmark stop working again?
A market's main address is often taken down or blocked by infrastructure attacks, so operators rotate mirrors to keep some access paths alive. Your saved link may simply point to an old route that is no longer maintained.
Do I really need a different setup on phone versus desktop for rotating mirrors?
The core process is the same: you open the current mirror in Tor and verify the address first. The main difference is that mobile Tor browsers may handle onion service subdomains or redirects less predictably, so re-checking the URL after the page loads is even more important there.
If I find several mirror links for the same market, which one should I trust?
None of them should be trusted until you confirm that the domain matches the format and identity you already know for that market. Prefer links from sources you have used successfully before, and avoid links shared in public comments, random messages, or newly created profiles.
Is it safe to keep using a mirror that worked yesterday if the market says it changed today?
No, because a working-looking old mirror can be replaced by a lookalike page or a stale clone. Always treat a link as valid only for the current session after you have checked it against your own saved reference, not based on past availability.