How to Verify You're on the Real XMRS Onion
On the dark web, the most common way people lose funds is not a broken protocol — it is sending to a phishing clone. An attacker copies a swap site pixel-for-pixel, hosts it on a lookalike onion address, and changes one thing: the deposit address. You do the swap perfectly, and your coins go to them. Before you send anything to any onion service, including this one, confirm you are where you think you are.
Why onion phishing is so effective
Confirm the address, not just the look
The onion string is the identity of the service. A clone cannot reproduce the genuine full address — only approximate it. So:
Verify the deposit address every single time
Even on the genuine site, the last mile can be attacked:
Basic Tor hygiene while you're at it
If something feels off, stop
A mismatched character, an address that changed between visits, a support message volunteering a new payment address, a page nudging you to lower your browser security — any one of these is enough to halt. Sending is irreversible; verifying costs a minute. When you have confirmed the full onion address from trusted, ideally signed sources and checked the deposit address on the live page, you can start a swap with confidence.
