Onion Site OSINT
Is an .onion address genuine, who runs it, and what's on it? This page validates the address, matches it against a directory of official onions and threat lists, flags phishing addresses that mimic well-known onions, then (on request) crawls the site over the Tor network from the server, so you don't have to open it yourself.
Check an onion address
Enter an .onion address (or URL) to check its reputation. Enter a clearnet domain (e.g. nytimes.com) to find its official onion via Onion-Location. Tick "Crawl via Tor" to fetch the site's content.
Crawling is passive and runs on the server: only HTML text and the favicon are fetched, never images, scripts, or downloads. Addresses on the Ahmia blacklist, and pages with indicators of child sexual abuse material, are never shown. Found such material? Report it to NCMEC, the IWF, or your national hotline.
Crawling isn't enabled on this server (TOR_SOCKS_PROXY not set); only reputation checks run.
Try:
Enter an address above or pick one of the official onions below to get started.
Official onion directory
19Onion addresses announced directly by their owners. All pass the v3 checksum. Addresses that look similar to, but differ from, this list are flagged as lookalikes.
Data sources
Reputation feeds are cached for 6 hours on the server; per-address reports for 15 minutes.
- optional
Tor (SOCKS5) ↗
The server crawls through a Tor SOCKS5 proxy with an isolated circuit per scan. Only HTML/text and the favicon are fetched; no images, scripts, or downloads.
tor daemon · TOR_SOCKS_PROXY - feed
Ahmia blacklist ↗
MD5 hashes of onion addresses Ahmia removed from its index for child-abuse or other illegal content. Matching addresses are never crawled.
Ahmia - feed
ransomware.live ↗
Tracked leak and negotiation sites of ransomware groups, used to flag onions run by ransomware operators.
ransomware.live (Julien Mousqueton) - feed
Onion-Location ↗
The HTTP header or meta tag a clearnet site uses to announce its official onion address, used to verify that an onion really belongs to that domain.
Tor Project spec
How it works & onion OSINT techniques
- Validation: a v3 address is base32 of an ed25519 public key + a SHA3-256 checksum + a version byte. A bad checksum means the address is mistyped or deliberately faked, and no service can exist behind it.
- Onion phishing: scammers generate vanity addresses that share a prefix with well-known onions (e.g. duckduckgo…). Always compare all 56 characters, not just the start.
- Ownership verification: official clearnet sites announce their onion through the Onion-Location header. If the domain and the onion match, the address is genuine.
- Risk score = 30 + Σ signal weights (official onion −60, Onion-Location −40, ransomware +70, lookalike +45, brand impersonation +35, content categories +5 to +35), clamped to 0–100.
- Pivots from a crawl: the favicon hash (mmh3) on Shodan can find the same server on the clearnet; TLS certificate SANs, IPs on the page, and the Server header can leak the real location; PGP fingerprints and BTC/XMR addresses link operators across sites.
- The crawler uses an isolated Tor circuit per scan, respects robots.txt, caps at 6 pages (depth 2) and 1.5 MB per page, and prioritises about/contact/pgp/mirrors pages.
Ethics & limits
- For security research, threat intelligence, journalism, and verification only. Don't buy from, download from, or engage with illegal services.
- Child sexual abuse material is never crawled or shown. Report it to NCMEC, the IWF, or your national hotline.
- Automated scoring can be wrong: categories come from keywords, and an "unknown" address is neither proven safe nor proven harmful.