How to Verify the Legitimacy of an Onion Website on the Dark Web

The dark web isn’t just used for illegal activity. In fact, many legitimate online platforms support the “.onion” domain on the dark web for privacy reasons, including media outlets like ProPublica and BBC News, social media platforms like Facebook, and privacy-conscious messaging platforms like Proton Mail and SecureDrop.

But this also provides ideal cover for criminals and hackers who create clones of legitimate darknet sites to steal sensitive data and cryptocurrency from privacy-conscious users. And given the long and complex links on the Onymous network , it’s easy for users to accidentally click the wrong link and end up on a fake site instead of the real one. When the FBI seized 276 Onymous addresses during Operation Onymous in 2014, they discovered that 153 of them were phishing sites.

Fortunately, the Tor browser already includes a cryptographic feature that can verify the authenticity of a website on the Onion network by verifying end-to-end encryption and Extended Authentication Certificates. Here’s how this feature works, its shortcomings, and other red flags to look out for.

How does darknet phishing work?

While phishing on the darknet works the same way as on the regular internet, scammers have several unique advantages due to the secretive nature of this environment. Most importantly, you can’t simply look at an onion link to determine whether a site is legitimate. Regular website URLs are typically short and memorable, while onion links are 56-character strings of alphanumeric text that look mostly like gibberish.

When attempting to connect, Tor Browser verifies the URL against the cryptographic key of the original website, ensuring that no one has hijacked the address or modified it. However, since this has the undesirable effect of making domains harder to remember, it makes it much easier for scammers to create similar addresses or clone websites.

For example, many popular websites use “prefixes” to make their Onion URLs more recognizable or to add brand appeal. This means their 56-character Onion URLs might begin with something like “facebook,” “bbcnews,” or “ciadotgov.” However, scammers can use a free tool like mkp224o to generate similar URLs with the same prefix as a legitimate website, lulling users into a false sense of security.

Of course, most darknet users don’t enter URLs directly into the Tor browser; they use darknet directories like Hidden Wiki to find useful sites online that match their searches. Scammers create fake search engines or link directories to direct users to their fake websites, as was the case in 2015, when the Ahmia search engine discovered that a copy of its platform was redirecting users to 255 cloned services.

Of course, it’s possible to launch phishing attacks that don’t involve cloning websites at all. Researchers from the Free University of Berlin describe a sophisticated technique in which attackers use their own reverse proxy to access a legitimate website, allowing them to manipulate specific parts of the site or log your online activity without your knowledge. In 2019, ESET even discovered a trojanized version of the Tor browser that substituted Bitcoin addresses on websites for direct payments to hackers. Thus, both legitimate websites and your browser itself are vulnerable to manipulation if you download or access them from an untrusted source.

How to verify the authenticity of a website on the Tor network in the Tor browser

There are several recommendations for preventing phishing attacks when using the darknet . None of them are completely foolproof, but taken together, they significantly reduce the risk of landing on a fake or modified website.

1. The Tor project has a feature called Onion-Location , which allows websites to advertise the availability of a dark web version for users who prefer greater privacy. When you open a regular TLS-enabled website through the Tor browser, if a purple “Onion version available” button appears in the address bar, you can click it to access the official Onion link associated with that website.

2. In the desktop version of Tor Browser, you can access a site on the Onion Network using a shortened version of its URL, called an Onion Name. Currently, this feature only works with SecureDrop , so editors can create message threads with addresses like mysitename.securedrop.tor.onion, which will then redirect to the original 56-character Onion address. This feature is under active development, so other platforms may support it in the future.

3. When you visit a website using the Tor network, you’ll see an onion icon in the address bar, confirming the end-to-end encryption of the connection. However, you can also click the onion icon to check if the site has an Extended Validation (EV) certificate, which verifies that its authenticity has been verified by a trusted certificate authority, such as DigiCert. While not every legitimate site using the Tor network has an EV certificate, well-known sites like Facebook typically do.

4. On the other hand, if you see a warning sign next to the onion icon, it means the site is using a self-signed or expired certificate, which isn’t guaranteed to be secure by a trusted certificate authority. It may also indicate that the site is accessing an insecure URL. This doesn’t guarantee that it’s a phishing site, but it’s still a red flag worth paying attention to.

5. Don’t rely too much on search engines, link directories, Reddit threads, or Telegram channels on the dark web. Once you’re sure you’ve found the local address of a legitimate website, bookmark it so you can access it directly the next time you want to visit.

What should you do if you suspect you have become a victim of phishing?

If you realize you’ve been the victim of a phishing attack, the first thing you should do is close the browser window with the fake site and go to the real onion address to reset the passwords for any accounts you may have accidentally shared.

Additionally, for additional security, we recommend enabling two-factor authentication and PGP login for all darknet accounts that support it. If you downloaded Tor Browser from anywhere other than the official Tor Project website , uninstall it immediately and download a new copy from the official website.

More…