Why this ledger lists three strings
Hidden-service markets typically publish more than one v3 address so a single overloaded or seized front does not erase the whole hostname set. Public commentary in 2026 often claims Torzon rotates a pool of sixteen mirrors — the highest redundancy figure this directory records for any current English-language shop. Two pressures sit behind that number: denial-of-service against a single onion, and the compromise of one front while others still answer. Sixteen fronts raise the cost of knocking a brand fully offline. They also raise the cost of verification, because phishing clones prefer vanity prefixes that look like the real first eight characters.
This directory does not attempt to reprint every string that has ever appeared in a screenshot. A long rotating set goes stale faster than a static clearnet page can honestly track. We maintain a short, stable ledger of three listings that this publication currently associates with the name. Completeness is not the same as care.
A short list is also a trade-off. It is easier to review and harder to vandalize in our own HTML. It is incomplete relative to any longer operator-published set. If a listed host does not resolve, try the next row — and then stop treating this page as a status dashboard. We do not probe onion uptime from this clearnet host on a live graph.
How operators are said to publish the rest
Public descriptions say the administrative team posts a PGP-signed URL list on the Dread subdread named for the market, and that a warrant canary is updated on a stated cadence. Those channels belong to the operators. This directory will not paste a canary, will not host a substitute key, and will not pretend to “continue operating the mirror network.” A signed list you can check against a key you already trusted outranks any clearnet HTML, including ours. Method: Security.
What mirrors are for, in this record
Two pressures show up again and again in write-ups of hidden-service commerce: denial-of-service against a single onion, and the compromise of one front while others still answer. Multiple hostnames raise the cost of knocking a brand fully offline. They also raise the cost of verification, because phishing clones prefer vanity prefixes that look like the real first eight characters.
This directory’s rule is mechanical: copy the entire string from the row, then compare the full address bar. Do not trust a page because the first word is “torzon”. Lookalikes live in the middle and the tail.
Rotation and staleness
Operators change URLs after attacks, seizures of a single mirror, or routine hygiene. A ledger dated 17 August 2026 can be wrong on 18 August. Inclusion here means “this publication still lists the string,” not “the host is authentic today.” Signed operator announcements — when you can verify the key independently — outrank any clearnet HTML, including ours.