The connectivity reference for the Torzon onion service. When your ISP throttles Tor, your national firewall enumerates guard IPs, or your corporate proxy permits only HTTPS to known fronts, bridge relays and pluggable transports remain reachable. Documented from reachability probes in 80+ geographies, against three geographically distributed mirrors, tested with obfs4, snowflake and meek-azure across the blocking techniques observed in 2026.
+1,200 volunteer WebRTC proxies added in April for high-censorship regions.
New bridge fingerprints rotated weekly to outpace IP enumeration.
Orbot 17.x and Onion Browser 3.x both confirmed against all 3 mirrors.
Three independent .onion endpoints hosted in distinct relay regions. Each one is reachability-tested every 15 minutes from probes in censored networks. Always verify the address against our PGP fingerprint.
Pick the mirror with the lowest measured latency from your bridge exit.
Highest capacity endpoint — best for users routing through obfs4 bridges.
Snowflake-friendly endpoint — recommended where guard IPs are enumerated.
meek-azure path tested through major CDN front — useful behind corporate proxies.
Only consume addresses published on this signed page. Bridge directories, paste sites and chat groups are routinely seeded with phishing replicas designed to harvest credentials when censored users panic-search for a working entry point.
A catalog spanning the categories below is reachable behind the bridge. Torzon enforces strict prohibitions on child exploitation content, weapons and hitman services regardless of jurisdiction. This page documents connectivity only.
Substance listings from globally distributed vendors.
Cards, credentials and forged documentation.
Penetration kits, exploit frameworks and offensive tooling.
Forged passports and identity papers.
Premium accounts, datasets and digital assets.
Trojans, ransomware kits and zero-day chains.
Privacy training and operational-security guides.
Dozens of additional categories once you're past the firewall.
Field notes from users behind hostile firewalls, corporate proxies and throttled residential ISPs. Not endorsements — descriptions of which transport defeated which blocking technique. Browse the connectivity features referenced here.
ISP started DPI fingerprinting Tor traffic last summer; direct guard connections began failing within seconds. Switched to a snowflake bridge from the published list — fingerprint rotated weekly, traffic statistically indistinguishable from a video call. Mirror β has been the working endpoint since.
Office network team began monitoring outbound TLS. meek-azure walkthrough on this site mapped the only working path — tunnel through a major CDN front so the egress looked identical to ordinary corporate traffic. Mirror γ stayed reachable throughout the change in monitoring posture.
No desktop access in this region — handset only. Orbot configuration page documented bridge import via QR code; first attempt connected. Mirror γ measured low latency on 4G, comparable to a local HTTPS site. Phone behaves identically to before the switch in transport.
Followed the self-host section and deployed a private obfs4 bridge on a $5/month VPS in a friendly jurisdiction. Five family members in censored regions now reach Torzon through it. Documented setup steps matched what was actually needed; no surprises during the install.
If every transport fails on your network, send your country and observed symptoms. We can often suggest a private bridge or test a fresh transport build. PGP-encrypted messages preferred.
Torzon Gateway is the connectivity layer in front of the Torzon onion service. The onion service itself runs on three Tor v3 hidden services hosted in geographically separate jurisdictions. The Gateway publishes the authenticated mirror addresses, distributes signed lists of bridge relays, and documents which pluggable transports defeat which blocking technique. We do not operate the marketplace's escrow or vendor systems — we make sure you can reach them when your network is hostile.
Most users with a free, neutral internet connection do not need any of this. Torzon's onion addresses are fully reachable through plain Tor Browser. The Gateway exists for the rest: residents of countries where guard nodes are blocked at the IP level, employees behind corporate firewalls that whitelist only HTTPS to known CDNs, journalists working from hotel networks that DPI-fingerprint TLS handshakes, and mobile-only users who depend on Orbot or Onion Browser.
For those readers, the Gateway maintains current bridge fingerprints, tested obfs4 / snowflake / meek-azure configurations, mirror reachability statistics broken out by region, and step-by-step recovery procedures for the moment when Tor itself appears blocked. Begin with the access guide; it walks every transport from identification of the blocking method down to a working connection.
An onion service you cannot reach is not reachable. The Gateway is the difference between a working connection and a stalled bootstrap.
Curated lists of obfs4 bridges with rotating fingerprints. New bridge IPs added weekly to outpace IP enumeration by national firewalls.
obfs4, snowflake and meek-azure all documented with concrete copy-paste configurations. Each tested against the blocking techniques observed in 2026.
Three independent .onion endpoints in distinct hosting regions. If a single region experiences upstream throttling, the other two stay reachable.
A condensed walk-through. The full access guide covers each step in detail with command-line examples.
Open Tor Browser and let it bootstrap. If you reach 100% in under 30 seconds you don't need this Gateway — go straight to the mirror addresses. If the bootstrap stalls or fails, your network is interfering and you need a bridge.
Stalls at 10% mean guard IPs are blocked at the firewall. Bootstrap completes but onion sites time out means deep packet inspection is fingerprinting Tor TLS. Different symptoms call for different transports.
obfs4 for general DPI evasion, snowflake when bridge IPs themselves are being burned, meek-azure for networks that only allow HTTPS to known CDN front domains. Configure inside Tor Browser → Connection Settings → Use a bridge.
Choose the mirror with the lowest probe latency from your bridge exit. Mirror α is best behind obfs4, β behind snowflake, γ behind meek-azure. Switch on first sign of throttling.
Open Tor Browser's Connection Settings, choose Use a bridge, and select a built-in obfs4 bridge or paste one of our published bridge lines. If obfs4 IPs are also blocked, switch to snowflake — it routes through volunteer WebRTC proxies whose addresses change constantly. The access guide walks through both.
A pluggable transport disguises Tor traffic so DPI cannot fingerprint it. obfs4 randomizes the bytes — works against most ISPs. snowflake hops through ephemeral WebRTC proxies — best where bridge IPs are constantly burned. meek-azure tunnels through Microsoft's CDN — necessary on corporate networks that only allow HTTPS to known fronts.
Vanilla Tor is detectable by passive traffic analysis because the TLS handshake is fingerprintable. With a pluggable transport over a private bridge the traffic looks like generic encrypted noise. Add a no-log VPN as an outer layer and an upstream observer sees only opaque data flowing to one IP — no Tor signature.
In Tor Browser open Settings → Connection → Bridges → Add a bridge manually and paste a bridge line in the format obfs4 IP:PORT FINGERPRINT cert=… iat-mode=0. Our bridge list is signed with PGP fingerprint 8C71 4F25 6A93 D182 E574 B91C 3D67 8F45 A2D6 C918 — verify before pasting.
Every blocking method we have documented in 2026 — IP-based, DPI fingerprinting, CDN-only egress — has a working countermeasure on this site. Reference the mirror endpoints and bridge configurations to get started.
View Mirror Endpoints