Onionland Review 2026: Mirror Churn Is Back, and the Clones Came With It

Why Onionland Review exists

Most onion-market coverage online falls into two camps: link directories that will list anything for a fee, and forum threads that repeat whatever the loudest poster claims. Neither camp grades a market against a fixed rubric, and neither one will print a low score if it costs them traffic or a placement deal. Onionland Review exists to be a third option: a reading journal that scores every onion market it covers against the same seven-dimension rubric, in public, with the losing grades left in.

The name is a description, not a brand flourish. This is a journal about the onion side of the darknet-market ecosystem specifically — Tor hidden services, not clearnet look-alikes — and every review, comparison and news item on Onionland Review exists to help a reader tell a genuine onion address from a clone before they paste it into a browser.

What "independent" means in practice here

No banner ads run on Onionland Review. No affiliate link anywhere on Onionland Review pays out when a reader clicks through to a market. No market, mirror operator, or promoter has ever paid to move up a list, appear in a comparison, or avoid an Avoid grade — and none ever will, even where refusing costs Onionland Review direct access or an early tip.

What a grade on Onionland Review actually represents

A score out of five on Onionland Review reflects the seven-dimension rubric documented on the methodology page: uptime pattern, security practice, escrow handling, vendor base, user experience, support responsiveness, and longevity. A Caution grade, like Torzon's, means real weaknesses sit alongside real strengths — it is not a euphemism for Avoid, and it is not softened to protect a relationship with anyone covered. An Unrated market, like Prime above, means the evidence does not yet exist to print a number, and Onionland Review would rather say that plainly than invent one.

What Onionland Review references, and what it leaves to the source

This journal does not try to duplicate general Tor education that is already maintained better elsewhere. For the mechanics of onion routing and hidden-service addressing, the Tor Project's own onion services documentation is the primary source Onionland Review defers to rather than re-explaining from scratch. For operational-security guidance beyond what a single market review can responsibly cover, the Electronic Frontier Foundation's Surveillance Self-Defense guide and Privacy Guides' Tor documentation cover browser configuration, bridge usage, and threat modeling in more depth than belongs in a market scorecard. Where a review references Monero specifically, the Monero project's own user guides are the reference Onionland Review points to rather than paraphrasing wallet mechanics secondhand. Onionland Review's own job stays narrow by design: grading markets against the seven-dimension rubric, not re-teaching Tor from first principles.

Inside the scorecard: seven dimensions, and why each one is therereview methodology in the open

A rubric is only worth anything if a reader can argue with it. The seven dimensions below are the whole of what an Onionland Review grade is made of. There is no eighth hidden dimension, no editor's discretionary adjustment applied at the end, and no weighting that shifts depending on which market is being graded. What follows is the reasoning behind each one — not only what it measures, but what failure looks like inside it, and why a market can be strong in six dimensions and still miss a Recommended grade when the seventh collapses.

These dimensions were not chosen in the abstract. Each exists because the public record of the past decade contains markets that failed in exactly that way, frequently while looking healthy in every other respect. That history is set out further down this page; the rubric is the shorter, more usable form of the same lessons.

1. Uptime pattern, not uptime percentage

We do not publish a percentage, because we do not run the probe network that would justify one. What we grade instead is the shape of a market's downtime. Is an outage announced in advance on a channel the market controls, or discovered by users hitting a dead address? Does downtime cluster around pressure a market cannot control, or arrive at random? And critically: when the service comes back, does it return at an address published beforehand, or at one that surfaces afterwards from sources nobody can trace? A market with an unremarkable uptime record and a predictable, pre-announced rhythm grades better here than a nominally more reliable one that disappears silently and reappears through a forum post. Failure in this dimension is not downtime. Failure is silence around downtime.

2. Security practice, as observable from outside

We are journalists, not auditors, and this dimension is written to stay honest about that limit. We do not claim to have reviewed anyone's server configuration. What we can observe and grade is practice: whether encryption of sensitive order data is required of vendors or merely offered, whether login and session handling are built so that a single phished credential does not immediately hand over an account, whether the operators publish addresses through a channel with continuity behind it, and whether their own public statements about security are specific enough to be falsifiable. A market whose security page is a paragraph of adjectives scores lower than one that describes what it actually does, precisely because the second can be checked against behaviour later.

3. Escrow handling

Escrow is a separate dimension rather than a footnote under security for one reason: escrow is where nearly every historical exit scam did its damage. What gets graded is how funds are held between order and release, whether early finalisation is quietly pushed onto buyers through interface design or promotional pressure, whether multisignature arrangements are genuinely offered or merely claimed in marketing copy, and how the market behaves once a dispute is actually open rather than how its rules page says it will behave. A market that nudges buyers to finalise before delivery is accumulating exactly the balance an exit scam eventually converts into a disappearance, and that pattern costs points here even when nothing has gone wrong yet.

4. Vendor base

Size is the least interesting part of this dimension. A large vendor roster is not automatically better than a small curated one, and a headline vendor count is one of the easiest numbers on a darknet market to inflate. What we grade is whether vendor reputation is portable, checkable and expensive to fake: whether history survives account changes, whether feedback can be traced to completed orders, whether obviously abandoned listings are pruned, and above all whether the market removes vendors when its own published record justifies removal. A market unwilling to act against a high-volume vendor with a documented pattern of failures is telling readers exactly where its priorities sit.

5. User experience, graded as a safety property

This dimension has nothing to do with whether a market looks modern. It measures how much room the interface leaves for a mistake that costs a reader money: how addresses are displayed and confirmed, how many irreversible actions can be triggered without a confirmation step, how clearly the interface distinguishes a genuine session from a hostile copy of it. The relevant failure is subtle and extremely common. A market front page that renders identically on a phishing clone, because nothing on it is bound to the address the reader actually typed, is a user-experience failure even when the real market is well run.

6. Support responsiveness

Cadence matters more than raw speed. A support desk that answers within three days every single time is more useful to a reader planning around it than one that answers in twenty minutes for a fortnight and then goes dark for three weeks without explanation. We grade consistency, whether dispute cases receive a substantive response rather than a template, and whether the queue degrades gracefully under load or simply stops. Torzon's Caution grade on this front page is driven substantially by this dimension, which is also the dimension that most often separates two markets that otherwise look near-identical on paper.

7. Longevity

Time on record matters, but this is the dimension we weight most carefully, because a long record is precisely the asset an exit scam spends. Markets that have operated for years without incident have demonstrated something real: they have survived pressure, and they have had opportunities to defect that they did not take. That earns the benefit of the doubt on genuinely ambiguous evidence. It never earns immunity from a downgrade, and it is never treated as a prediction. Several of the largest collapses in this ecosystem's history happened to venues with the longest records in it at the time.

What the rubric deliberately leaves out

Three things are absent by design. We do not grade prices or product catalogues, which is not our remit and would turn a review journal into a shopping guide. We do not grade "reputation" in the sense of aggregate sentiment, because sentiment on darknet forums is trivially manufactured and the loudest account is rarely the best informed one. And we do not test-buy. Every grade on Onionland Review is built from externally observable behaviour, public statements checked against later conduct, and documented incidents — not from transactions we conducted ourselves. That limits what we can claim, and stating the limit is more useful to a reader than quietly implying access we do not have.

When we print a number, and when we refuse to

A composite score out of five is only published when all seven dimensions have evidence behind them that we are willing to defend. When two or three dimensions are effectively blank, averaging what remains produces a number that looks more authoritative than the evidence underneath it, and readers reasonably treat a printed decimal as a measurement. That is why several cards on this page carry a qualitative grade and the words "no score" rather than a figure: the verdict is defensible, the arithmetic would not be. It is also why an Unrated market stays Unrated instead of drifting into a low score, which readers would misread as a finding rather than an absence.

The record that shaped this rubricseizures, exit scams, and what each one taught

Every dimension in the rubric above is a lesson someone else paid for. The public history of this ecosystem is not long, but it is dense, and it repeats. Reading it as a sequence of isolated news events makes darknet markets look chaotic and unpredictable. Reading it as a pattern makes the failures look almost scheduled — which is the more useful way for a reader to hold it.

2013–2014: seizure as the default ending

The original Silk Road was taken down by United States authorities in 2013, and its founder was arrested and later convicted. A year later, Operation Onymous removed Silk Road 2.0 along with a substantial batch of other hidden services in a coordinated international action. The lesson readers took at the time was that markets end through law enforcement, and that a market's real risk profile is largely invisible from the outside. The lesson the rubric took is narrower and more actionable: because a market's ending is generally not something a reader can predict, exposure should be sized as though any given venue could stop existing without notice.

2015: Evolution and the modern exit scam

Evolution vanished in 2015 with customer escrow balances, and the disappearance was carried out by operators of an established, well-regarded market rather than by an obvious fly-by-night operation. Public estimates of the amount taken varied widely and we do not repeat a figure here. What matters for a review methodology is the shape of it. The market did not deteriorate first. It performed normally right up until the moment it did not, which is the reason escrow handling is graded on this site as its own dimension, and the reason a pattern of pushing buyers toward early finalisation costs a market points long before anything visibly goes wrong.

2017: AlphaBay, Hansa, and the month nobody could see

The 2017 takedowns are the single most instructive episode in this history for anyone building a scorecard. AlphaBay, then the largest market of its era, was seized by an international operation; its alleged administrator died in custody in Thailand. What made the operation remarkable was what happened next. Dutch police had already covertly taken control of Hansa, a competing market, and continued running it — so that users displaced by the AlphaBay seizure migrated directly into a market operated by law enforcement, which collected their data while they used it. For roughly a month, Hansa's uptime was excellent. Its support was responsive. Every externally observable signal that a naive scorecard would reward looked good. This is exactly why no dimension on this site treats availability as a proxy for safety, and why we say explicitly, in the network-status note near the top of this page, that a market being reachable is not a claim that a market is sound.

2019: Wall Street Market, and a lesson aimed straight at reviewers

Wall Street Market ended in 2019 in the messiest way available: an apparent exit scam, followed closely by German-led seizure and arrests. The same year produced a case that concerns this journal more directly. DeepDotWeb, for years the most widely read news and link site covering these markets, was seized, and its operators faced charges over the kickbacks they had earned from referral links pointing readers to markets. The site had presented itself as journalism. Its incentives were those of an affiliate. Readers who trusted a link there had no way to see which of the two was driving the placement, because the payment was invisible at the point where the decision was made. That case is the specific reason the independence policy on this site is stated in absolute terms and repeated on the front page rather than buried in a disclosure page.

2020–2022: Empire, Hydra, and the limits of longevity

Empire exit-scammed in 2020 after operating at scale for a substantial period, which is why it carries a retrospective Avoid grade on this page and why any revival trading on the name should be read as a lure. Hydra, for years the largest Russian-language market, was seized by German authorities in 2022 after an unusually long run. Two different endings, one shared lesson: length of record is evidence about the past and is not a forecast. The rubric weights longevity accordingly — it moves a grade at the margin on ambiguous evidence, and it never overrides a documented problem in another dimension.

What the pattern actually tells a reader

Markets end. They end by seizure, by exit scam, by voluntary retirement, and occasionally by simply going quiet, and the ending is rarely visible in advance to anyone outside the operation. A review journal that pretended otherwise — that treated a Recommended grade as a prediction of continuity — would be selling something it cannot deliver. What a grade on this site claims is narrower and, we think, more honest: given evidence available now, here is how this market has behaved, in seven named respects, with the weak spots printed alongside the strong ones. Nothing in that sentence promises tomorrow. The historical record is included here precisely so that readers hold our grades at the right temperature, and so that the difference between "this has behaved well" and "this is safe" stays visible every time they read one.

How mirror rotation worksand why it opens a phishing window

This week's lead item covers three markets rotating addresses. Understanding why rotation happens, and why it is exactly when clones appear, is worth its own section rather than a passing mention in the news item.

Why an onion market rotates addresses at all

A hidden service can lose an address to sustained DDoS pressure, an operational security decision, or simple infrastructure migration. Rotating to a fresh onion is a normal, often defensive move — it is not inherently a red flag about the market itself, unlike an address going dark with no replacement announced anywhere.

Why rotation is the exact moment clones appear

The window between an old address failing and a new one becoming widely known is precisely when a phishing clone has the best odds: confused users searching for "the new address," forum posts spreading unverified links, and no settled canonical source yet for a newcomer to check against. Clone operators watch for rotation announcements specifically because that confusion is their opening.

What Onionland Review does during a rotation window

During an active rotation, Onionland Review treats every candidate replacement address as unconfirmed until it clears the same verification standard used for any other entry: reachability, content matching the expected market, and cross-referencing against a second independent source before print. A rotation in progress is reported as exactly that — in progress — rather than resolved before it actually is.

How to read an Onionland Review rotation note correctly

An Onionland Review rotation note is a snapshot, timestamped to the moment it was written, not a live feed. When Onionland Review reports "address rotating, new mirror unconfirmed," that status can change within hours — the honest response is to check back rather than treat the note as permanently current. Onionland Review would rather publish a rotation note that reads "unconfirmed" for a day than print a new address before the verification standard above has actually cleared it, even though the slower, more cautious version of the note is less exciting to read.

What Onionland Review will never do during a rotation

Onionland Review will not print a candidate replacement address sourced only from a forum thread or a single unverified tip, no matter how many people in that thread vouch for it. The bar stays the same during a chaotic rotation window as it is on any ordinary day: reachability confirmed, content matching the expected market, and a second independent source before anything goes into an Onionland Review page as a verified address. Lowering that bar during exactly the window when a phishing clone is most likely to appear would defeat the entire purpose of running Onionland Review as a cautious, slower-moving reference in the first place.

How to read a mirror-rotation reportincluding ours

The section above covers why rotations happen. This one covers something different and, for a reader, more immediately useful: how to read the reporting about a rotation, on this site or anywhere else. Almost every loss that follows a rotation involves someone who did read the news and still ended up on a clone, because the report they read did not distinguish between an address that was claimed and an address that was checked — and nothing in its wording forced them to notice the difference.

Five questions separate a rotation report worth acting on from one worth waiting out. They apply to our own filings as much as anyone else's, and a report that cannot answer them is not necessarily wrong; it is simply not yet finished.

• Who is the source?Did the new address come from a channel the market itself controls and has used before, or from a third party relaying it? A relayed address is a lead, not a fact, no matter how many people in the thread agree with it.
• Was it verified, or only reported?"The market announced a new address" and "we reached the new address and it behaved as expected" are different claims. Careful reporting keeps them in separate sentences. Sloppy reporting merges them into one, and the merge is where readers get hurt.
• What is the timestamp on the check?Not the publication date of the article — the date of the verification. A piece published today can rest on a check performed a fortnight ago, and during an active rotation window a fortnight is an eternity.
• Is a second independent source cited?One source confirming an address is a claim. Two independent sources agreeing is evidence. During rotation windows, the gap between those two states is exactly where clone operators do their work.
• Does the report say what it does not know?A rotation report that admits an address is still unconfirmed is more trustworthy than one that reads as settled everywhere. Confident-sounding coverage during a chaotic week is a warning sign, not a reassurance.

Why a rotation report goes stale faster than any other kind

Ordinary market coverage ages slowly. A review's reasoning about escrow design or support cadence is broadly as valid in a month as it was on publication day. Rotation reporting is the opposite: it is a statement about the state of the network at one moment, and the moment it describes may already have passed by the time a reader arrives from a search engine weeks later. That asymmetry is why every address printed on this site carries a specific last-checked date, and why we would rather publish a note that reads unconfirmed for a day than a clean-looking one that turns out to be a clone's address.

The failure mode nobody expects

The dangerous rotation report is not the obviously wrong one. It is the one that was completely accurate when written and is quietly consulted six weeks later by someone who never noticed the date. A clone operator does not need to publish disinformation to exploit that; they only need to register a plausible look-alike address and wait for the ordinary decay of correct information to work in their favour. Reading rotation news well therefore means reading the metadata — source, verification, date, corroboration — with the same attention as the address itself. That habit is worth more than any single verified address a journal can hand a reader, because it keeps working after our snapshot expires.

What Caution vs Avoid actually meansreading a verdict correctly

The four verdict labels used across Onionland Review's reviews look simple, but each one carries a specific, deliberate meaning that is worth spelling out once, in full, rather than leaving readers to infer it from context.

Recommended: real strengths, no disqualifying flaws

A Recommended grade, like Nexus above, means the seven-dimension rubric turned up no disqualifying weakness and at least several clearly strong dimensions. It does not mean risk-free — no onion market coverage on Onionland Review claims that — it means the balance of evidence is clearly positive.

Caution: real weaknesses next to real strengths

Caution, Torzon's current grade, is the label most often misread as a soft Avoid. It is not. Caution means specific, named weaknesses (in Torzon's case, dispute handling and mirror stability) sit alongside genuine strengths (uptime, encryption practice) — a reader should weigh both, not just the label.

Avoid: a clear, evidenced disqualifying problem

Avoid is reserved for a documented disqualifying issue — an exit scam, as with Empire, or comparable evidence of harm to users. It is never used simply because a market is unfamiliar or under-covered; that situation gets Unrated instead.

Unrated: not enough verified evidence, stated honestly

Unrated, Prime's current status, means the rubric has not been completed for that market because sufficient verified evidence does not yet exist — not that the market is assumed bad. Printing Unrated instead of guessing a number is a deliberate editorial choice, not an oversight.

How Onionland Review decides when a grade needs revisiting

A grade printed on Onionland Review is not permanent. It is revisited when something material changes: a documented security incident, a sustained pattern shift in one of the seven rubric dimensions, or enough elapsed time that the original evidence base is no longer current. Onionland Review does not re-run the full rubric on a fixed calendar for every market regardless of whether anything changed — that would waste effort on markets that are stable while under-checking ones going through real turbulence. Instead, Onionland Review prioritizes re-review around the markets showing the most change, which is also why the "Recent grade changes" list above tends to cluster around markets already flagged elsewhere on this page.

Why "no paid rankings" is the load-bearing promiseincentives, stated out loud

Every review publication says it is independent. The claim is cheap, and readers know it is cheap, so it is worth explaining what specifically is being promised here and what the promise costs us — because a promise with no cost attached is decoration.

The commercial model available to a site covering this ecosystem is well established and highly profitable. A market pays for placement, or pays a share of what referred users spend, and the payment is invisible at the exact point where a reader makes a decision. The order of a list looks like editorial judgement. It is a rate card. The DeepDotWeb case described above is the clearest documented example: a widely trusted news and link resource whose operators were charged over kickbacks earned from referring readers to markets. Readers who used that site had no way to distinguish the reporting from the revenue, because the two arrived in the same typeface.

What the policy actually forbids

No market, mirror operator or promoter pays to appear on Onionland Review, to move up a list, to be included in a comparison, or to avoid an Avoid grade. There is no affiliate code embedded in any link. There is no arrangement in which coverage is traded for access, early tips, or an interview. And there is no category of "sponsored" content on this site at all, labelled or otherwise, because a labelled advertisement sitting beside a review still exerts pressure on the review next to it.

What it costs

It costs access, routinely. Market operators talk to publications that are useful to them, and a journal that will print a Caution grade is less useful than one that will not. It costs speed, because a rotation announcement often reaches affiliate-funded sites first. And it costs revenue that would otherwise be straightforward to collect. Those costs are the point: a policy that is free to maintain provides a reader with no information about the publisher, because anybody would maintain it.

How a reader can check the claim rather than trust it

Do not take the policy at face value — test it against the output. An independent publication produces negative coverage of popular subjects, because the honest distribution of quality in any ecosystem is not uniformly positive. It publishes Unrated when it does not know, rather than filling the gap with a mid-range score that keeps a page looking complete. It leaves failed and closed markets on the record with retrospective grades instead of silently deleting them once they stop being commercially relevant. And when it changes a grade, it dates the change and states the reason instead of editing the number in place. Those four behaviours are checkable from outside on any given day. That is the standard we would like to be held to, and the one this front page is arranged to make easy to verify.

Recent grade changeslogged, not silently edited

When a grade on Onionland Review changes, the change is dated and the reason is stated — never a silent edit to a published score. This is the current changelog for grades covered on this edition's front page.

• Torzon: Caution grade reaffirmed 2026-08-23 following this edition's mirror-churn review; dispute-handling weakness remains the primary drag on the score.
• Empire: no change. Retrospective Avoid grade stands from the 2020 exit scam and is not subject to further revision absent new evidence.
• Prime: remains Unrated pending sufficient verified data across the seven-dimension rubric.

How Onionland Review differs from a directory or a status boardscope, stated plainly

Readers sometimes land here looking for a live uptime dashboard or a comprehensive address directory, and it is worth being explicit about why Onionland Review is neither of those things by design. A directory's job is completeness: list every known address for every known project, updated as fast as possible. A status board's job is currency: show what is reachable right now, refreshed continuously. Onionland Review's job is neither — it is judgment, applied slowly and stated honestly, to a smaller set of markets we have actually done the work to evaluate.

That narrower scope is a deliberate tradeoff, not a limitation we are working to remove. A journal that tries to also be the fastest directory and the most current status board ends up doing all three jobs worse, because each one rewards a different kind of speed-versus-care tradeoff. We link out to dedicated directory and verification projects for the jobs they do better than we would, and we keep our own remit to what a review, a comparison, or a piece of mirror-rotation reporting can responsibly claim: a snapshot, dated, with the reasoning shown.

What this means practically for a reader

Use Onionland Review to decide which market fits your situation and to understand why a grade is what it is. Use a dedicated, continuously-checked directory for the current address of record at the moment you actually need to connect. The two jobs complement each other; neither substitutes for the other, and treating a review site's last-checked date as a live status is the single most common way a reader here gets burned by a rotation Onionland Review has not yet re-verified.

Why Onionland Review still bothers with news and comparisons, not just scores

A bare numeric grade answers "how good is this market," but it does not answer "how does this market compare to the one I already use" or "did anything change this week that affects a market I already trust." That is why Onionland Review runs a comparisons section and a mirror-churn news feed alongside the core reviews, rather than shipping scores in isolation. A reader who already picked a market from an Onionland Review score still needs to know when that market's mirror rotates, or when a competitor closes a gap the original review flagged — the score alone goes stale faster than the reasoning behind it, which is why Onionland Review keeps revisiting covered markets rather than publishing a review once and leaving it untouched indefinitely.

Frequently asked questionsplain answers