Before you enter a password
Telling a real Osiris mirror from a clone
A clone is only as good as the moment you stop checking. The checks below take about a minute in total and rule out every pattern that actually shows up in the wild. Do all of them, in this order, before you type a password.
- osiriseultmx3so5ef6ayasy4kdyekbywr7pyggpmjazeogxoyaodsyd.onion
- osirislivpetlbabbl3zzqhupurfkxxbzbheu3bkrshkaiwg2hcxbyqd.onion
- osirisydmlx47esm6ylhzhtnjrucgnymi7beqoyzze5jn3opbr3zy4id.onion
The six checks
The prefix
A real Osiris address begins with the literal text osiris. All three mirrors above do. Variants like osirismarket, osiris-mkt, osirismkt, or osirix are different strings and, in this niche, different websites.
The length
Count the characters between the start and .onion. It is 56, no more, no less. v3 onions are always 56 base32 characters. If yours is 16, it is an old v2 address from a different market or a different era.
The alphabet
v3 onions use base32: the letters a to z and the digits 2 to 7. There is no 0, no 1, no 8, no 9, and no uppercase. A single 0 inside the address means it is not a v3 onion, and it is not one of the three above.
The last six
Compare the last six characters in the address bar against what you copied. Typos cluster at the end of long strings, because that is where reading stops. Vanity attacks keep the front of the address familiar and randomize the back. Six characters is enough to catch both.
The signed announcement
The operator publishes the mirror set on Dread with a PGP signature. Import the public key once, and every future post can be checked in seconds. A post without a signature, or signed by a key you do not recognize, is from someone else. Links that exist only on Telegram, Reddit, or in an email have not passed this check. Assume clone.
The page banner
Once the market loads, it displays its own onion address on the page. Read it against the address bar, character by character. A clone that gets the address bar right but prints a different onion on the page has handed you the answer.
What a mismatch means
| Mismatch | What it is | Do |
|---|---|---|
| Different prefix | A different project, or a clone built on the name | Do not log in |
| 16 characters | Wrong onion version | Do not log in |
| A 0, 1, 8, or 9 inside | Not base32, not a v3 onion | Do not log in |
| Last six differ | A typo, or a vanity clone | Re-copy, new circuit, check again |
| Banner differs from the bar | You are on a clone | Leave the tab |