How to verify the official ShadowX onion link

Phishing clones of ShadowX appear within hours of every mirror rotation and every DDOS event. This page explains the three checks that separate the real .onion from a fake. None of them require special software beyond what you already have for Tor.

Check one: the PGP signature

The ShadowX admin posts a clearsigned message every time a mirror address changes. The message contains the new .onion address and is signed with the admin's private key. The public key is posted on the ShadowX market itself and on the community forum.

To verify: open the announcement in the ShadowX forum, click "verify signature," and compare the fingerprint against the one on the market. The current admin key fingerprint ends in 360D76. If the signature says "good" and the fingerprint matches, the address in that message is the real one.

If you are reading a link from a random blog, a Telegram channel, or a Reddit comment and there is no PGP signature attached, treat it as unverified. It may still be correct, but you have no cryptographic proof that it is.

Check two: the address structure

Every ShadowX .onion address follows a specific pattern. The string starts with "shadowx" followed by a 52-character base32 sequence, then ".onion." The full address is 63 characters long including the ".onion" suffix.

Common fakes break this pattern in predictable ways. They use a different prefix ("shad0wx" with a zero, "shadowx-market"), a shorter string (48 characters instead of 52), or a completely different domain. If the address you have does not start with "shadowx" plus exactly 52 base32 characters, it is not a ShadowX address.

The two addresses currently listed on this page both follow the pattern. You can count the characters yourself if you want to be sure.

Check three: independent directory confirmation

Three directories that are not run by the ShadowX team independently verify and list ShadowX mirrors: UnderDir (underdir.org), dark.contact, and onion.live. All three check PGP signatures and uptime on their own schedules.

If the address you have is listed as "verified" on at least two of these three directories, the probability that it is a clone is very low. The directories are not perfect. A new clone can exist for a few hours before a directory catches it. But for a first-time visitor, two-directory confirmation is a solid practical check.

When none of this is enough

There is one scenario where all three checks pass and you are still in trouble: the ShadowX admin key itself was compromised. This has not happened to ShadowX as of the last update, but it has happened to other markets. The only defense is to monitor the forum for an urgent key rotation announcement. If the admin posts "new key, old key is dead," every previous signature is void and you need to re-verify from scratch.

Practical advice: do your first purchase within a week of a mirror rotation, not three months later. The longer you wait, the more time a compromised key has to drain your escrow before anyone notices.

Quick reference

PGP fingerprint (last 6 chars): 360D76. Address prefix: "shadowx" + 52 base32 chars. Directories to cross-check: underdir.org, dark.contact, onion.live. If all three align, you are on the real market. If any one of them disagrees, close the tab and start over.