The dark web isn’t just for illicit activities. In fact, many legitimate online platforms maintain a “.onion” domain on the dark web for privacy reasons, including media outlets like ProPublica and BBC News, social media sites like Facebook, and privacy-conscious communication platforms like Proton Mail and SecureDrop.
But this also provides perfect cover for criminals and hackers who create clones of legitimate dark web sites to steal sensitive data and cryptocurrency from privacy-conscious users. And given that onion links are long and jumbled, it’s easy for users to accidentally click on the wrong link and end up on a fake website instead of the real one. When the FBI seized 276 onion addresses during 2014’s Operation Onymous, they found that 153 of them were phishing sites.
Thankfully, Tor Browser already has a cryptography-backed feature that can verify the authenticity of an onion site, by confirming whether it has end-to-end encryption and extended validation certificates. Here’s how this feature works, where it falters, as well as what other red flags you should look for.
How phishing works on the dark web
While phishing on the dark web works as it does on the clear web, scammers have a few unique advantages due to the secretive nature of the environment. Most importantly, you can’t just glance at an onion link to tell if the site is genuine. Normal website URLs tend to be short and memorable, while onion links are 56-character strings of alphanumeric text that look mostly like gibberish.
When you try to connect, Tor Browser verifies the URL against the originating website’s cryptographic key, which is how you know nobody has hijacked the address or tampered with it midway. But since this has the unwanted effect of making domains harder to recall, scammers have a much easier time generating lookalike addresses or creating website clones.
For example, many popular websites use “vanity prefixes” to make their onion addresses more easily identifiable or to add some branding appeal. That means their 56-character onion link starts with something like “facebook,” “bbcnews,” or “ciadotgov.” But scammers can use a free tool like mkp224o to generate lookalike addresses with the same vanity prefix as the legitimate website, which gives users a false sense of security.
Of course, most dark web users don’t type addresses directly into Tor Browser; they use dark web directories like the Hidden Wiki to find useful onion sites relevant to their search. Scammers will create fake search engines or link directories to point users to their fake websites, like when the Ahmia search engine discovered that a copy of its platform was directing users to 255 cloned services back in 2015.
What do you think so far?
Of course, it’s possible to orchestrate phishing attempts that don’t involve cloning sites at all. Researchers at Freie Universität Berlin describe a sophisticated technique where attackers serve the real website through their own reverse proxy, which lets them manipulate parts of the site or log your online activity without your awareness. In 2019, ESET even found a trojanized version of Tor Browser that replaced Bitcoin addresses on websites to direct payments to hackers. So both genuine websites and your browser itself are also vulnerable to manipulation if you download or access them from an unverified source.
How to verify an onion site in Tor Browser
There are a few best practices to avoid phishing attacks when using the dark web. None of them are foolproof on their own, but together, they considerably lower the risk of ending up on a fake or manipulated website.
The Tor Project has a feature called Onion-Location, which lets clear web websites advertise that they have a dark web version available for users who prefer more privacy. If opening a regular TLS-backed website using the Tor Browser reveals a purple “onion available” button in the address bar, you can click on it and be redirected to the official onion link associated with that site.
On the desktop version of Tor Browser, you can access an onion site using a shortened version of its URL called an Onion Name. For now, this feature only works with SecureDrop, so newsrooms can establish tip lines with addresses like mysitename.securedrop.tor.onion, which would then redirect to the 56-character original onion address. This feature is in active development, so more platforms might support it in the future.
When you load up an onion site using the Tor Browser, you’ll see an onion icon on the address bar, which confirms that your connection is end-to-end encrypted. But you can also click on the onion icon to check if the site has an Extended Validation (EV) certificate, which tells you that its authenticity has been verified by a trusted certificate authority like DigiCert. While not every legitimate onion site will have an EV certificate, famous ones like Facebook tend to.
On the other hand, if you see a caution sign next to the onion icon, that means the site is using a self-signed or expired certificate that isn’t guaranteed by a trusted authority. It may also imply that the site is being served over an insecure URL. This doesn’t definitely tell you it’s a phishing site, but it’s a red flag to watch out for nevertheless.
Don’t rely on search engines, link directories, Reddit threads, or Telegram channels too heavily on the dark web. Once you’re sure you’ve found the onion address for a genuine site, bookmark it so you can access it directly the next time you want to visit.
What to do if you think you’ve been phished
If you realized that you’ve been the victim of a phishing attempt, the first step is to close the browser window with the fake site and access the real onion address to reset any account passwords you may have accidentally divulged.
Also, generally try to enable two-factor authentication and PGP logins on any dark web account that supports it for added security. And if you downloaded Tor Browser from anywhere other than the official Tor Project site, uninstall it now and grab a fresh copy from the official address.