Link-Site Safety and Onion Verification

General
1

:link: Link-Site Safety and Onion Verification

On the darknet, finding the correct .onion address is one of the most important security steps you can take. Phishing sites often look nearly identical to legitimate services and may steal login credentials, cryptocurrency, or other sensitive information.

:shield: Don’t Trust a Link Just Because It Works

A working .onion address does not prove that a site is legitimate. Phishers can create convincing copies of real sites, including identical login pages, logos, and layouts.

Avoid blindly trusting:

  • Links posted by random users in forums, chats, or social media.
  • Search-engine results claiming to list onion services.
  • Unsolicited links sent through private messages.
  • Link directories you’ve never verified.
  • Links copied from screenshots, videos, or comments without another way to verify them.

:magnifying_glass_tilted_left: Verify Onion Addresses

Whenever possible, obtain an onion address directly from the service’s official source.

For important sites, verify the address through more than one independent trusted source. The complete onion address should match exactly.

For services that publish PGP-signed announcements or link lists, verify the signature using a previously trusted copy of the service’s public key. A valid signature provides much stronger evidence that the information came from the holder of that key.

How to Verify a PGP-Signed Onion Announcement

A PGP-signed announcement can help confirm that an onion address or important message was published by the person or service that controls a previously trusted PGP key.

What You Need

You need:

  • The complete signed announcement, including the PGP signature.
  • A trusted copy of the onion sites public PGP key.
  • GnuPG (gpg) or a trusted graphical OpenPGP application.

The most important part is obtaining the public key from a source you already trust. Such as a subdread, If a phishing site gives you both the announcement and the public key, a successful signature check proves very little—the phisher could have created both.

Typical: publickey=Subdread

Signed announcement=Link Site ex: daunt Tor.watch

1. Import the Trusted Public Key

If you have the public key saved as service-key.asc, import it:

gpg --import service-key.asc

You only need to import the key once.

2. Save the Signed Announcement

A clear-signed announcement commonly looks similar to this:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Our official onion address is:
exampleexampleexample.onion

-----BEGIN PGP SIGNATURE-----
...
-----END PGP SIGNATURE-----

Save the entire message exactly as published as something like:

announcement.asc

Don’t copy only the onion address—the signature covers the signed message.

2b. You can also just copy the signed announcement then paste it into notepad on kleopatra. Then click decrypt and verify button.

If the publickey is on your keyring it will verify whether it’s a valid signiture or not. Best for beginners.

3. Verify the Signature

Open a terminal in the directory containing the file and run:

gpg --verify announcement.asc

If verification succeeds, GnuPG should report a:

Good signature

It will also identify the key that created the signature.

4. Check the Key Fingerprint

A Good signature alone isn’t enough. Confirm that the signing key is actually the trusted key you expected.

Display its fingerprint with:

gpg --fingerprint

Compare the entire fingerprint with a fingerprint you previously obtained from a trusted source.

:warning: What Verification Actually Proves

A valid signature means the announcement was signed by the private key corresponding to that public key and that the signed text hasn’t been modified since it was signed.

It does not automatically prove that the public key belongs to the claimed service.

That’s why the trust chain matters:

Trusted public key → Valid signature → Onion address contained in the signed message

Once you’ve successfully verified an onion address, bookmark it so you don’t have to rely on link directories or search results every time.

Important: A PGP signature is only useful if you already have confidence that the public key itself is authentic.

:police_car_light: Watch for Phishing

Be suspicious if a site:

  • Shows a slightly different onion address than the one you saved.
  • Asks for information it normally doesn’t request.
  • Suddenly provides different cryptocurrency deposit addresses.
  • Pressures you to deposit funds or act quickly.
  • Has broken pages, unusual wording, or unexpected login behavior.

Bookmark verified onion addresses rather than searching for them again every time.

:white_check_mark: Best Practice

Find → Cross-check → Verify → Bookmark

Treat onion addresses like cryptographic identifiers—not ordinary website names. A few extra seconds spent verifying a link can prevent you from handing credentials or funds directly to a phishing site.