One Wrong Character: How Onion Typosquatting Sends Users to Impostor Servers
A .onion address is not a name that gets looked up somewhere. It is a cryptographic public key, and every one of its characters is load-bearing. Change a single letter and Tor does not show you an error page - it calmly delivers you to someone else's server.
There is no such thing as almost
On the regular web, a typo in a domain usually means a failed lookup or a registrar-owned error page. Onion services have no DNS, no registry, and no certificate authority watching over spelling. The 56-character v3 address is derived directly from an ed25519 key pair, as the Tor Project explains, so any two addresses that differ even slightly belong to two entirely different operators. That design is excellent for censorship resistance and terrible for human memory. Nobody memorizes 56 random-looking characters. Users rely on bookmarks, copied links, forum posts, and directories - and each of those handoffs is a chance for a substitute address to slip in unnoticed.Lookalike onions are a documented industry
This is not a theoretical worry. A study presented at the APWG eCrime symposium analyzed what the authors call malicious mimicry of onion services and found systematic cloning of darknet marketplaces, akin to traditional typosquatting on the web. The clones replicated site functionality closely enough to harvest credentials and funds from users who thought they had arrived at the right place. The same paper describes why the technique works so well: trust on the dark web flows through complex webs linking markets, forums, and mirrors. When a well-known service changes addresses - which legitimate services genuinely do - attackers rush to publish their own \"new official address\" first. The impostor often reaches confused users before the real announcement does. Clearnet security teams see the same pattern. Zscaler's ThreatLabz researchers documented typosquatting and brand-impersonation campaigns across thousands of phishing domains, with internet services the most heavily spoofed vertical. Tor simply removes the last safety net: there is no takedown request for an onion address.Even the watchdogs get cloned
The sites people consult to avoid scams become scam targets themselves. Dark.fail, which publishes PGP-verified onion addresses for major services, carries a standing warning that copies of the directory exist and reminds visitors that the real domain always has a dot between \"dark\" and \"fail\". Its advice is blunt:Don't get phished. Always PGP verify .onion and Bitcoin addresses before interacting with them.That warning exists because attackers copy everything - layout, branding, even key fingerprints. Community incident reports describe fake mirror hubs that published addresses signed with forged signatures, counting on users who check that a signature exists but never confirm that it verifies.
The habits that actually hold up
Verification does not require paranoia, only consistency. Researchers compiling anti-phishing guidance for onion users converge on a small set of practices, including the character-by-character comparison of addresses against a known-good source before first contact. Our own onion validator automates the format checks, and our verification guide walks through the full routine step by step. The core checklist fits on an index card:- Bookmark the address after verifying it through two independent sources, then reuse the bookmark.
- Prefer PGP-signed address announcements; a signature must verify, not merely exist.
- Paste, never type. Manual entry of 56 characters invites exactly one kind of mistake.
- Treat unexpected address changes as hostile until proven otherwise.
- Distrust helpful strangers offering \"the new official link\" in comments or DMs.