# TorPortal

> Verified onion addresses for active Tor markets in 2026 with working mirror lists, a hand picked dark web news feed, evergreen how-to guides and a free public JSON API. Onion mirror: http://torportbymf56ref5lqztbbsz7vunmkrkxsn47l67yaayvghmjqz2xid.onion

TorPortal is a directory. We do not run any of the shops and we do not handle payments. Content is written in plain English and updated as things change. Everything is also available as JSON, no key needed.

For a full text dump of guides, glossary and market details in one file, see https://torportal.online/llms-full.txt

## About

- [About TorPortal](https://torportal.online/about): What we cover, what we do not, and where the news comes from.
- [FAQ](https://torportal.online/faq): Common questions about Tor, onions, Monero, PGP and market shopping.
- [Glossary](https://torportal.online/glossary): Plain English definitions for Tor market terms.

## Markets

- [All markets](https://torportal.online/markets): Full directory of active Tor markets for 2026.
- [Compare markets](https://torportal.online/markets/compare): Tor markets side by side, by year, coins and mirror count.
- [Nexus Market](https://torportal.online/markets/nexus): Nexus Market onion address plus three live mirrors, each checked for reachability. Takes Bitcoin, Litecoin and Monero. Copy a link and open it in Tor.
- [Anubis Market](https://torportal.online/markets/anubis): Anubis Market onion address with three live mirrors, checked and ready to copy. The only shop here taking Bitcoin, Litecoin, Ethereum and Monero.
- [TorZon Market](https://torportal.online/markets/torzon): TorZon Market onion address with four backup mirrors, all reachability checked. Bitcoin and Monero accepted, with a queue that absorbs flood traffic.
- [Awazon](https://torportal.online/markets/awazon): Awazon Market onion address and three live mirrors, checked and ready to copy into Tor Browser. Bitcoin and Monero accepted, ordinary shop layout.
- [WeTheNorth (WTN)](https://torportal.online/markets/wethenorth): WeTheNorth onion address with three live mirrors, checked for reachability. Bilingual English and French, built around Canadian buyers. WTN for short.
- [Osiris Market](https://torportal.online/markets/osiris): Osiris Market onion address with three rotating mirrors, all checked. Bitcoin and Monero accepted, and it stays reachable under flood pressure.
- [Crown Market](https://torportal.online/markets/crown): Crown Market onion address and live mirrors, checked and ready to copy. Bitcoin and Monero accepted, with a clean interface that loads on Safest.
- [Mars Market](https://torportal.online/markets/mars): Mars Market onion address with several live mirrors, each checked for reachability. Takes Bitcoin, Litecoin and Monero, and holds a strong uptime…
- [BlackOps Market](https://torportal.online/markets/blackops): BlackOps Market onion address with three live mirrors, checked and ready to copy. Monero only and escrow backed, so no transparent chain payments.

## Guides

- [How to buy Monero anonymously in 2026](https://torportal.online/guides/how-to-buy-monero-anonymously): Buy Monero without a KYC exchange. Compare RoboSats, Bisq, HodlHodl, Cake Wallet and P2P options. What each costs, what you have to trust.
- [How to verify a Tor onion address with a PGP signature](https://torportal.online/guides/how-to-verify-onion-pgp-signature): Check that an onion address is real by verifying its PGP signature against the market key. Step by step for GPG, Kleopatra and command line.
- [Tor Browser hardened setup for market shopping](https://torportal.online/guides/tor-browser-hardening): Configure Tor Browser for buying on Tor markets in safety. Security slider, JavaScript, screen size, bridges and the small habits that keep the browser boring.
- [Tails vs Whonix vs Qubes for Tor market shopping](https://torportal.online/guides/tails-vs-whonix-vs-qubes): Three operating systems for using Tor markets safely. What each protects against, what each fails at, and how to pick the right one for your threat model.
- [Multisig on Tor markets, what 2-of-3 actually means](https://torportal.online/guides/multisig-on-tor-markets): How a 2 of 3 multisig deposit works on a Tor market, why it beats classic escrow, and what the shop can and cannot do with your money.
- [How to buy Bitcoin without KYC in 2026](https://torportal.online/guides/how-to-buy-bitcoin-without-kyc): Non KYC ways to buy Bitcoin that still work in 2026. Bisq, RoboSats, ATMs, cash by mail, and what to avoid. Real fees, real waits.
- [How to spot a fake Tor market mirror](https://torportal.online/guides/spotting-fake-market-mirrors): Concrete signs a Tor market mirror is a phishing clone. Address checks, captcha reveals, missing anti-DDoS queue, freshly indexed link farms.
- [Every big Tor market that died, and how it died](https://torportal.online/guides/dead-tor-markets-timeline): A short history of the Tor markets that mattered and what killed each one. Silk Road, AlphaBay, Hansa, Dream, Empire, Hydra and the lessons under each.
- [How to read a Tor vendor review page](https://torportal.online/guides/how-to-read-vendor-reviews): What to actually look for in Tor vendor reviews. Fake five stars, disputed order ratios, product-specific complaints and the timing patterns that give games away.
- [Finalize early, when to say yes and when to walk](https://torportal.online/guides/finalize-early-when-to-say-yes): FE (finalize early) drops escrow protection. Almost always the wrong call, but there are edge cases. Real red flags, real safe cases, and how to test a vendor first.
- [OpSec checklist for Tor market buyers](https://torportal.online/guides/opsec-checklist-for-buyers): Ten OpSec rules that keep Tor market buyers out of trouble. Covers browser, coins, addresses, PGP, comms and the small habits that give people away.

## News

- [Dark web news](https://torportal.online/news): Fresh Tor and dark web news from trusted sources.
- [News RSS](https://torportal.online/feed.xml): RSS feed of the latest stories.
- [New Evooo1Bot Linux botnet turns routers into traffic relay nodes](https://torportal.online/news/600/new-evooo1bot-linux-botnet-turns-routers-into-traffic-relay-nodes): A new Mirai-based modular Linux botnet malware called Evooo1Bot has been targeting internet-facing gateway devices, turning them into… (source: BleepingComputer)
- [How Anthropic plans to watermark Claude's AI-generated text](https://torportal.online/news/599/how-anthropic-plans-to-watermark-claude-s-ai-generated-text): It could soon become easier to identify AI-generated content, even if it's not the usual "It's Not X, it's Y" type of post you'd come… (source: BleepingComputer)
- [Investigation of banking hack leads to arrests in Europe, Brazil](https://torportal.online/news/598/investigation-of-banking-hack-leads-to-arrests-in-europe-brazil): Germany’s federal police agency, the BKA, said three suspects were picked up in Europe and charged with fraud, and Brazil’s federal police… (source: The Record)
- [Hackers arrested over €30M bank fraud exploiting service provider flaw](https://torportal.online/news/597/hackers-arrested-over-30m-bank-fraud-exploiting-service-provider-flaw): Four cybercriminals were arrested in Brazil, and three others were charged in Europe over allegations that they exploited a vulnerability… (source: BleepingComputer)
- [Hackers exploit macOS Screen Sharing flaw to deploy Monero miner](https://torportal.online/news/596/hackers-exploit-macos-screen-sharing-flaw-to-deploy-monero-miner): The Netherlands' National Cyber Security Centre (NCSC) is warning that hackers are actively exploiting a macOS authentication bypass… (source: BleepingComputer)
- [The Modern Attack Chain: Rethinking Google Workspace Security in the Age of AI](https://torportal.online/news/594/the-modern-attack-chain-rethinking-google-workspace-security-in-the-age-of-ai): Google Workspace attacks do not always begin with phishing. Stolen OAuth tokens can provide another path into Gmail, Drive, and connected… (source: BleepingComputer)
- [Max severity SAP Commerce Cloud flaw now targeted in attacks](https://torportal.online/news/595/max-severity-sap-commerce-cloud-flaw-now-targeted-in-attacks): A maximum-severity SAP Commerce Cloud remote code execution vulnerability patched three days ago is already being targeted in attacks… (source: BleepingComputer)
- [France investigates tax authority breach after hacker claims 600,000 victims](https://torportal.online/news/591/france-investigates-tax-authority-breach-after-hacker-claims-600-000-victims): French authorities confirmed that someone gained unauthorized access to systems at the Directorate General of Public Finances in late June… (source: The Record)
- [10 Harm Reduction Mistakes People Make Without Realizing It](https://torportal.online/news/589/10-harm-reduction-mistakes-people-make-without-realizing-it): Learn about 10 common harm reduction mistakes, from using alone and mixing substances to ignoring warning signs, tolerance changes, and… (source: DarkDotWeb)
- [Not Everyone Involved in Drugs Is a Monster](https://torportal.online/news/590/not-everyone-involved-in-drugs-is-a-monster): Why I believe not everyone involved in drugs should be treated as a monster, and why some criminal sentences raise serious questions about… (source: DarkDotWeb)
- [Shell investigates 'potential incident' after Clop data theft claims](https://torportal.online/news/593/shell-investigates-potential-incident-after-clop-data-theft-claims): Oil giant Shell has confirmed it is investigating a potential security incident after the Clop ransomware gang claimed it stole 89GB of… (source: BleepingComputer)
- [Who’s Tracking You? Use This New Service to Find Out](https://torportal.online/news/592/who-s-tracking-you-use-this-new-service-to-find-out): It can be daunting to determine who's responsible for showing ads on the websites we visit, or who's harvesting data from the mobile apps… (source: Krebs on Security)
- [RingCentral data breach exposed info of 1.6 million accounts](https://torportal.online/news/588/ringcentral-data-breach-exposed-info-of-1-6-million-accounts): The ShinyHunters extortion group stole personal information from 1.6 million RingCentral accounts after hacking the company in July… (source: BleepingComputer)
- [Data analyst sent to prison for stealing data, extorting employer](https://torportal.online/news/587/data-analyst-sent-to-prison-for-stealing-data-extorting-employer): A former data analyst contractor for Brightly Software has been sentenced to two years in prison for targeting his employer in a $2.5… (source: BleepingComputer)
- [Apple sends new ‘Threat Notification’ alerts over mercenary spyware attacks](https://torportal.online/news/586/apple-sends-new-threat-notification-alerts-over-mercenary-spyware-attacks): You're not alone if you just received an "Apple Threat Notification" saying it detected a "mercenary spyware attack targeted at your… (source: BleepingComputer)
- [Ukraine shuts down 94 fraudulent call centers, seize millions in cash](https://torportal.online/news/584/ukraine-shuts-down-94-fraudulent-call-centers-seize-millions-in-cash): Authorities in Ukraine shut down 94 fraudulent call centers across the country that lured people into investment scams or tried to obtain… (source: BleepingComputer)
- [Akira hackers disable EDR with Safe Mode, steal data but fail to encrypt](https://torportal.online/news/585/akira-hackers-disable-edr-with-safe-mode-steal-data-but-fail-to-encrypt): An Akira ransomware affiliate disabled the endpoint detection and response (EDR) solution on a compromised system by restarting the machine… (source: BleepingComputer)
- [Hackers breach govt webmail while running parallel crypto fraud](https://torportal.online/news/581/hackers-breach-govt-webmail-while-running-parallel-crypto-fraud): The Jewelbug hacker group has been carrying out espionage operations targeting governments and militaries while also engaging in… (source: BleepingComputer)
- [Microsoft patches LegacyHive Windows zero-day vulnerability](https://torportal.online/news/582/microsoft-patches-legacyhive-windows-zero-day-vulnerability): Microsoft has released security patches to address a Windows zero-day vulnerability known as "LegacyHive," disclosed after the July 2026… (source: BleepingComputer)
- [AI 'watermark removers' flood the web. Almost none can prove they work.](https://torportal.online/news/583/ai-watermark-removers-flood-the-web-almost-none-can-prove-they-work): Multiple 'watermark removers' have surfaced days after Anthropic began watermarking text generated by Claude, including an open source… (source: BleepingComputer)
- [Flock tightens privacy controls amid scandals over officer abuse](https://torportal.online/news/579/flock-tightens-privacy-controls-amid-scandals-over-officer-abuse): All Flock Safety customers will be required to adopt its "Audit Assistance" feature for tracking abnormal uses, and the company says it… (source: The Record)
- [Critical VMware vCenter RCE flaw exploited for reverse SSH access](https://torportal.online/news/580/critical-vmware-vcenter-rce-flaw-exploited-for-reverse-ssh-access): A recently patched critical vulnerability (CVE-2026-59310) in VMware vCenter Syslog Server is being exploited in an active campaign to… (source: BleepingComputer)
- [New Mirai variant adds stealth capabilities to notorious botnet code](https://torportal.online/news/578/new-mirai-variant-adds-stealth-capabilities-to-notorious-botnet-code): Beyond Mirai’s usual functions, the new code features include encrypted communications with command-and-control servers and a “sniffer”… (source: The Record)
- [Trezor discloses data breach affecting nearly 14,000 customers](https://torportal.online/news/577/trezor-discloses-data-breach-affecting-nearly-14-000-customers): Hardware wallet manufacturer Trezor disclosed a data breach affecting nearly 14,000 of its customers after ShipMonk, its shipping and… (source: BleepingComputer)
- [Who Vets AI’s Code? The Scale Challenge Facing Open Source Ingestion](https://torportal.online/news/576/who-vets-ai-s-code-the-scale-challenge-facing-open-source-ingestion): AI coding tools can introduce unvetted or hallucinated open source dependencies faster than traditional security reviews can keep pace… (source: BleepingComputer)
- [Brazil orders Discord to suspend livestreaming after teen suicide](https://torportal.online/news/574/brazil-orders-discord-to-suspend-livestreaming-after-teen-suicide): Discord's Go Live feature contributed to a 13-year-old girl's death by suicide, according to Brazilian regulators, who told the company to… (source: The Record)
- [White House taps security firms for offensive hack-back operations](https://torportal.online/news/573/white-house-taps-security-firms-for-offensive-hack-back-operations): A new White House memo signed by U.S. President Donald Trump instructs the National Coordination Center (NCC) to establish a program that… (source: BleepingComputer)
- [Trump taps cyber firms to go on offensive against criminals](https://torportal.online/news/575/trump-taps-cyber-firms-to-go-on-offensive-against-criminals): The Trump administration will allow private companies to launch attacks on cybercrime organizations, the White House announced. (source: The Record)
- [Germany moves to give spy agencies hacking and sabotage powers](https://torportal.online/news/572/germany-moves-to-give-spy-agencies-hacking-and-sabotage-powers): Germany’s cabinet approved legislation that would let its intelligence agencies hack foreign systems, sabotage adversaries’ supply chains… (source: The Record)
- [£232M Cocaine Seized in NCA Investigation](https://torportal.online/news/568/232m-cocaine-seized-in-nca-investigation): The NCA seized 2.9 tonnes of cocaine worth £232 million at London Gateway Port after it was hidden in a shipment of bananas. (source: DarkDotWeb)

## API

- [API overview](https://torportal.online/api): List of endpoints. Read only, no key, free.
- [Markets JSON](https://torportal.online/api/markets.json): All markets with primary onion and mirror list.
- [News JSON](https://torportal.online/api/news.json): News feed, paginated.
- [Prices JSON](https://torportal.online/api/prices.json): Current BTC/LTC/XMR prices in USD with 24h change.
- [Sources JSON](https://torportal.online/api/sources.json): News sources we pull from.