Torzon Market PGP Verification Tutorial: How to Verify Mirrors & Spot Phishing ClonesGot your browser and keyring ready in Part 1? Now check the address before you log in. Match the key's full fingerprint, verify the signed mirror list, and watch for a cloned login page. If the page asks for your recovery words during a normal login, close it and go to the breach response checklist.
Once your trusted key is set up, the routine check is quick. Take the time to read the whole address.
First, get the market key from /pgp.txt. Compare all 40 characters of its fingerprint with an independent copy, such as the one posted on /d/Torzon on Dread. Next, verify the signature on /mirrors.txt in Kleopatra or with gpg --verify. A Good signature is useful only after you have checked the key. Finally, compare the entire 56-character onion address with the signed list.
A key from the same site you are trying to verify proves little on its own. Compare the fingerprint from /pgp.txt with copies from /d/Torzon and another source you have checked independently. Read all 40 characters. Matching the last eight is not enough.
Anyone can copy a page, but signing a new mirror list requires the corresponding private key. Verify the list's signature and check the canary's signature and date separately. Kleopatra may say "Not enough trust" if you have not established trust in that key. Check its fingerprint against a source you trust before relying on the signature, then read all 56 characters of the mirror address.
A link directory is another place an attacker might slip in a bad address. Check the signature against a key you verified elsewhere. Then move on to registration and login checks.
Check the phrase, 2FA, and PIN in the context where each belongs.
Register only after checking the mirror. Choose a username that does not point back to you, and use a fresh password, PIN, and PGP key. Buyer and vendor accounts are separate: vendors cannot buy, and an account that has made a purchase cannot become a vendor account. If the captcha makes a lowercase l look like a capital I, try the lowercase letter first.
Check your personal phrase before typing a password. If the account offers PGP 2FA, use it and keep the private key offline. Store your six-digit PIN and mnemonic recovery code separately from the browser. Recovery words belong in the recovery form on a mirror you have verified, never in a normal login prompt; the FAQ explains the recovery flow. Stealth Mode hides product images, and Premium buyers may receive a private mirror link after five completed orders.
Before entering credentials, run through the five clone checks. A convincing captcha is not one of them.
A proxy can show you a working captcha and live listings. The page can still be a trap.
A reverse proxy forwards the real site's pages while capturing what you type. It may even swap a payment address or a vendor's PGP key at checkout. Check the full signed onion address before login and watch for changes later in the session. A vendor pushing you to Telegram or Discord, or changing keys without signing the replacement with the old key, deserves a closer look.
| Check | Genuine mirror | Phishing clone |
|---|---|---|
| 56-character address | Full address appears in the signed /mirrors.txt | Only the beginning and end look familiar |
| Personal phrase | Your phrase appears at the expected point in the login flow | Phrase is missing, wrong, or appears too late |
| Mnemonic request | Recovery form asks for it | Normal login asks for recovery words |
| Vendor PGP key and payment address | Match the details you independently checked | Details change without explanation |
| Signed list | Address is in the verified signed block | Address is absent from that block |
If you typed credentials into a suspect page, act now. These time slots show the order of work, not a promise that you can finish in three minutes.
Use New Identity in Tor Browser. Open a mirror from the Home list and verify its signed address before entering anything.
On the verified site, use the recovery form with your mnemonic code and six-digit PIN. Set a new password and check for any option to sign out other sessions.
Replace the PGP key used for 2FA and update your personal phrase. Check the account settings for any other changes you did not make.
Review open orders and wallet details for changes. If you need to attach a photo to a ticket, inspect it offline and remove identifying details and metadata before sharing it. A filter cannot guarantee that an image is anonymous.