Skip to content
Drughub

What a Darknet List URL Actually Means and How to Read One

A directory entry is a signpost, not a door — here is how to tell the difference before you click.

11 min read

ReadIf the List URL…

Anatomy of a Darknet List URL: What Each Part Tells You

A darknet list URL is a directory pointer, not a market address: its structure shows who published the pointer, what path or directory the pointer sits in, and how the list operator groups entries — which directly shapes how they relate to market availability by indicating whether you are reading a raw mirror list, a category page, or a third-party index.

The first fragment after http:// is the onion hostname. A 56-character v3 address ending in .onion identifies a single hidden service; a 16-character v2 address is obsolete and often dead. The hostname tells you nothing about the site’s legitimacy, but a v2 hostname on a current list signals stale or unmaintained sourcing.

1schemehttp:// marks a cleartext onion request inside Tor
2hostname.onion identifies the service that serves the list
3pathsegments after / show category, region, or list subset
4query?mirror=1 or similar adds a selector, not a new address

The path after the hostname is where most list URLs become unreliable. A path like /markets/shop-onions may be a directory category, while /out/abc123 commonly indicates a redirect or click-counter, not the market itself. A fragment such as #up only points to a heading on the page; it cannot change which service the browser resolves.

  1. Read the hostnamethe only part a browser actually resolves to a hidden service
  2. Read the pathshows list nesting and whether the entry is a redirect
  3. Ignore anchors#section never selects a different market mirror
  4. Check for query parameters?id= may track a click, not verify a mirror

Directory site structure also explains apparent “up/down” labels. Many list pages render the same marker beside every returned row and do not test the onion until you click, so a URL ending in /market-x can appear identical to /market-x?mirror=2 while resolving to two different hidden services.

Important

A list URL that contains a .onion string in the middle of its path is a redirect wrapper, not a primary market link; copy the full destination, not the visual shortcut text.

Tip

Think of a list URL as a library card, not a book: the card tells you which shelf to search, while the market onion is the item itself.

Why Does a Listed Onion Look Real but Still Not Open a Market?

A listed .onion that does not open a market usually means you are holding a directory record, not a verified endpoint: the list stores metadata about a site, while the actual market URL lives elsewhere and may have already rotated, died, or been replaced by the operator.

Most list entries are snapshots with a delay. The directory scanned the onion at some earlier moment, recorded its title, uptime, mirror count, and a URL string, then published that row. The string can look complete, with the correct http:// prefix and a 56-character v2 or v3 address, yet no longer resolve because the hidden service key changed or the server behind it was taken down after the scan.

Think of a list entry as a catalog card in a library: the card gives a shelf number, but the book may have been moved, borrowed, or withdrawn. The card itself is real; the current location is not.

  • Directory metadata is not a live request
  • An onion can be “up” at scan time and dead minutes later
  • Some list sites never re-test old rows once they are cached
1You copy the onion from a listyou hold text, not a confirmed route
2Tor tries to resolve the addresshidden service descriptor may be absent or unpublished
3The introduction points reply or time outmarket rotated its key, changed mirrors, or stopped serving
4Your browser shows “Unable to connect” or loopsthe directory row is stale even though the string looked real

Most common causes, fastest checks first

  • Stale mirror after a DDoS or key rotation
  • Phishing row seeded into the list
  • Operator intentionally discontinued that endpoint
Important

A plausible-looking v3 onion that fails once is not automatically a phishing link; repeated failure on several circuits, while other sites open normally, points to a stale or rotated endpoint rather than your connection.

Tip

Treat any single list row as a starting hint: confirm through a second source that uses a different scan time before you call the link dead.

How Do You Tell a Verified Market Link from a List Entry?

A verified market link is an onion address published or acknowledged by the market operator, while a list entry is a third-party copy — sometimes accurate, sometimes stale, sometimes a phishing replacement. The distinction is not in how the URL looks; it is in where control over the address sits and how recent the source is.

Verified link
an onion address whose operator directly confirms it through an official channel, such as a signed message, PGP-signed announcement, or an authenticated mirror listed inside the market itself;; List entry
AttributeVerified market linkList entry
Sourcemarket operator or signed mirror setthird-party directory, paste, forum, or crawler ;; Rotation control

A practical one-minute check works like this: open two independent list URLs claiming to be the same market. If both show identical wallet or login behaviour but differ in onboarding text, support key, or escrow script details, at least one is a clone. A genuine market does not change its deposit wallet generation or dispute flow just because the directory changed.

The safest placement for a verified address is inside a market page you already reached: for example, a signed message posted from the account or wallet you used before. Anything that appears only in lists is a suggestion, not a confirmation. Treat a list as a map drawn by strangers, not as a door you own.

What Should You Check Before Treating Any List URL as Usable?

Before treating any list-sourced onion as usable, verify two things: that the entry is not stale and that the address has not been silently replaced by a clone. A listed URL is a pointer, not a guarantee; a list can look current while pointing to a domain that was rotated, seized, or mirrored by a third party weeks ago.

The three checks that matter most

  1. StepHover or copy the full onion string and compare it character-by-character with a second, independently saved source. A one-character difference near the middle of the address is enough to send you to a different service.
  2. StepOpen the link only in a fresh Tor session with JavaScript disabled, then note whether the page title, PGP banner, and login layout match the market you intended.
  3. StepAfter the page renders, check whether the URL in the address bar changed. A redirect from the listed address to another onion is a red flag, not a sign of normal rotation.
Tip

Check the timestamp style of the list itself: entries labelled only "checked" without a date, or dates older than the market's known rotation window, are stale by default.

A clone survives by looking right for the first ten seconds. Verification rituals built around visual recognition fail because the attacker copies the visual layer; what they rarely copy correctly is the cryptographic identity and the redirect behaviour.

  • Compare the onion against a PGP-signed announcement, not another list entry
  • Watch for a second onion appearing after the first page load
  • Treat any URL that asks for credentials before showing the market's signed welcome as compromised
Important

Never send a deposit, message, or 2FA code after arriving from a list entry that opened through a redirect — even if the final page looks correct.

FAQ

What does the /?ai= part in some darknet list URLs mean?

The part after ? is a query string. It can carry a referral tag, a session token, or a tracker value, and it does not change which onion service the address points to. Treat such extra parameters as untrusted unless you know exactly who added them and why.

Why do darknet lists show the same market name with several different .onion addresses?

Markets often rotate mirrors to spread load and survive downtime, so multiple valid addresses can exist for one service. A list may collect old, new, and mirror addresses without clearly separating them. The safest interpretation is that each address is a separate claim needing independent verification.

Can I verify a list entry just by opening it in Tor Browser and seeing a login page?

Seeing a login page only proves that something responded at that onion address; it does not prove the service is the market you expected. Phishing clones copy login pages to steal credentials. Verify the address against a source you already trust outside that list before entering any information.

Why does a URL with the same main name as the market sometimes lead to a blank page or error?

The onion address may be offline, the mirror may have been retired, or the entry may be inaccurate. A name in a list is not proof that the address was ever operated by the real market. If it does not open consistently, do not keep retrying with different settings or credentials.

When a Darknet List Says “Up” but Your Connection Fails, What Does That Signal?

A directory saying “up” means only that its last automated check completed, not that your circuit can complete. The most common cause is a timing gap: the list may have probed the onion minutes or hours before you tried it, while the service rotated guards, moved a mirror, or entered a captcha-only state. If the listed address does not open on your end, the signal is stale status, not necessarily a seized or scamming market.

Check the cheap explanations first

  1. Load the same address again with a new circuitPress New Identity or restart Tor Browser and retry once. A single bad guard or exit node often resolves immediately.
  2. Try a different listed mirror if the directory provides oneSame market, different onion — this separates a dead address from a dead service.
  3. Refresh the directory page itselfIf your cached copy is older than the status you are reading, the failure is on your side.
  4. Retry without a proxy or bridge setting you rarely useCustom bridges occasionally fail only on certain circuits.
  5. Wait and treat it as a probe gapIf a check ran at minute 0 and you connected at minute 12, the market may already have shifted to another address.
1Directory probe finishes“Up” is recorded at time T
2Service rotates guard or mirrorAddress now resolves differently
3You load the listYou see a status no longer true
4Your browser failsConnection ends before the service pages fully load
Tip

If the same onion opens five minutes later with a new circuit, the list was not lying — it was just reporting the past.

Important

Do not treat repeated status pages like “up, 2 minutes ago” as reliable input for a deposit. Status age is a metadata field, not a guarantee.

When “up” plus failure is a real warning

A second pattern is mirror-specific failure: one address is reachable for the directory but not for users in your exit region or your Tor Browser build. That is why list entries should be read as candidates, not as confirmed official fronts. The third, rarer pattern is captcha-walling: the service answers the probe’s HTTP request, but your real browser session stops at a proof-of-work or CAPTCHA page that the automated check never solved. The list still shows “up,” while your screen shows nothing usable.

In short, a failing connection after an “up” label collapses into three checks: retry on a fresh circuit, compare against a second mirror, and note how old the status actually is. If only one listed entry fails and another opens, you are seeing address rotation. If every entry fails for hours while statuses keep updating, you are seeing either a Tor-side routing problem or a service that only probes successfully from certain paths.

SymptomLikely meaningWhat to do
One mirror fails, another opensAddress rotation or region-specific routeKeep only the working mirror ;; One mirror fails for hours, status updates
Tip

Treat the “up” flag like a timestamp, not a verdict: it tells you when something answered, not whether it will answer for you.

If the List URL Keeps Misleading You: Escalation and Safer Alternatives

Replacing one misleading list URL with the next entry on the same page usually repeats the failure; the efficient move is to stop testing row by row and switch to a trust anchor you already verified previously. Keep a local copy of the known-good onion, a PGP-verified announcement, or a market-issued private mirror, and treat any directory as only a hint until it matches one of those anchors.

Escalation order

  1. Retry the same entry oncea changed guard or temporary circuit reset can explain a single timeout
  2. Check the directory's own status page if one existssome lists publish last-check time and exit flag separately
  3. Compare the suspected onion against a saved verified linkcharacter-level difference is enough to reject it
  4. Check the market's signed announcement or canaryabsence of a fresh signature weakens every listed URL
  5. Stop using that list category for direct entryroute through a known mirror or saved bookmark instead
  • A list entry that keeps "opening" a clone is worse than one that times out: the clone feeds the same habit that the list exploits.
  • A directory cannot upgrade an unverified onion into a verified one by adding a green "online" badge.
  • Verification must come from something outside the list, not from the list's own re-check.
The list tells you what someone wants you to try. The saved anchor tells you what you already trust.
Note

If one listing page repeatedly points to lookalike addresses, the entire list should be demoted to a research index, not an entry point.

Tip

Do not bookmark a directory page as your route to a market; bookmark the verified onion and treat directories as a fallback for cross-checking availability only.