> Torzon Gateway — MIRROR ENDPOINT MAP
Three independent Torzon onion mirrors hosted in distinct relay regions. Each endpoint is reachability-probed every 15 minutes from monitoring nodes inside censored networks. The full address list is signed with our PGP key. Last reachability sweep: UTC
REACHABILITY MONITOR — PER REGION, PER TRANSPORT
Probes connect from inside three of the most aggressively filtered networks we have access to. Latency is measured circuit-end-to-end through the indicated transport.
PGP-SIGNED ADDRESS LIST
The only mathematically reliable way to confirm an onion address came from the Gateway team. Reject any list whose signature does not validate against the fingerprint below.
ADDRESS HYGIENE CHECKLIST
Three checks every reader should run before pasting any onion address into Tor Browser.
Source Discipline
Bookmark this page and revisit it from your existing browser before each session. Bridge directories, paste sites and chat groups are seeded with phishing replicas, especially after any visible blocking event.
Signature Validation
Apply our PGP public key against the signed address bundle. A valid signature is the only authentic chain of trust.
v3 Onion Format
Every authentic Torzon endpoint is exactly 56 base32 characters before .onion. v2 addresses (16 characters) are deprecated and should be treated as hostile.
Users frantically searching for "fresh torzon link" after a national block rolls out are the highest-value targets. Operators of phishing replicas know exactly when censorship intensifies and seed bridge channels with replacement addresses that capture credentials silently.
- NEVER trust onion addresses dropped in censorship-help chatrooms or Telegram bridge groups
- NEVER log in unless the full 56-character address matches one of the three above byte-for-byte
- ALWAYS validate the PGP signature on the address bundle, not just the display on this page
- ALWAYS bookmark this Gateway and return to it whenever you need a fresh endpoint
WHY THREE GEOGRAPHICALLY DISTRIBUTED MIRRORS
Single-endpoint marketplaces fail the moment one upstream provider buckles under throttling, DDoS or coordinated AS-level filtering.
Mirrors α, β and γ run in three distinct hosting regions, on three independent network paths, with three separate guard relay sets. The Gateway designs around the assumption that any one of those regions will, eventually, become unreachable — temporarily blocked, throttled, or simply slow. When that happens the remaining mirrors keep responding, and the reachability monitor on this page reflects which one to use right now.
The pairing between mirror and transport is not arbitrary. Mirror α sits behind upstream relays that handle obfs4 traffic with the lowest jitter, so users on residential ISPs that DPI-fingerprint Tor TLS get the best experience here. Mirror β has been tuned for snowflake's WebRTC churn, suiting users in regions where bridge IPs are constantly burned. Mirror γ is the only endpoint we recommend behind meek-azure — useful when the local network whitelists HTTPS to Microsoft CDNs and nothing else.
All three are Tor v3 onion services (56-character addresses) with end-to-end encryption from your browser to the marketplace backend. None of them ever exit Tor, so no clearnet observer — including a cooperating CDN — sees the request payload. The Gateway's job is simply to keep the entrance reachable. Once you are past the bridge and the mirror responds, the rest of the marketplace is identical regardless of which endpoint you used.
FIRST TIME PUNCHING THROUGH?
The bridge configuration walkthrough covers obfs4, snowflake, meek-azure, mobile (Orbot & Onion Browser) and the procedure for self-hosting a private bridge when nothing else works.
Open the Access Guide