Verification Methodology & Research Team
Our Mission
TorzonWatch was established as an independent cybersecurity research initiative focused on one specific problem: the proliferation of fraudulent network endpoints that impersonate legitimate services within the Tor network ecosystem. Users searching for authenticated routing addresses routinely encounter phishing replicas engineered to harvest authentication credentials — a threat our forensic analysis estimates affects thousands of individuals monthly.
Our response is a cryptographic verification database. Rather than asking users to trust any single source, we provide PGP-validated endpoint records that security-conscious individuals can independently authenticate through established signature verification protocols. The goal is straightforward: reduce the credential harvesting success rate by making verified reference data publicly available and continuously maintained in our endpoint verification database.
We do not endorse, promote, or participate in any transactions conducted on the platforms we document, as detailed in our research disclaimer. TorzonWatch functions as an observational and analytical resource — the cybersecurity equivalent of a certificate transparency log. Our interest is defensive: identifying authenticated endpoints, flagging known phishing indicators, and publishing verified data that helps users distinguish real addresses from credential harvesting traps.
Verification Methodology
Our verification infrastructure operates on a continuous 6-hour cycle, performing automated integrity checks against every endpoint in our registry. The pipeline consists of four stages: PGP digital signature validation against independently obtained operator keys, TLS certificate fingerprint comparison across consecutive verification windows, endpoint response pattern analysis measuring header signatures and latency baselines, and cross-referencing against our maintained database of 847 documented phishing indicators.
The PGP validation stage is the foundation. We obtained the Torzon Market operator's public key through multiple independent channels in late 2024 and have maintained a verified copy in our keyring since that date. Every canary statement — the operator's signed declaration confirming current addresses — is validated against this cryptographic key before any endpoint enters our active registry. False-positive rate across 2,900+ verification cycles: below 0.1%.
Our anomaly detection system monitors for behavioral deviations that may indicate endpoint compromise even when PGP signatures remain valid. Changes in response header composition, unexpected latency spikes beyond established baselines, and alterations to TLS handshake fingerprints all trigger escalation to manual review by our security assessment team. This layered approach means our verification database reflects not just signature validity but ongoing operational integrity.
Research Team
TorzonWatch is maintained by a distributed team of network security researchers, threat intelligence analysts, and infrastructure engineers with collective experience spanning over two decades in cybersecurity research. Our team members have backgrounds in penetration testing, incident response, and cryptographic protocol analysis across both clearnet and overlay network environments.
The monitoring infrastructure runs from geographically distributed nodes in Europe and North America, providing multi-region endpoint response data and reducing the risk of localized network conditions affecting our verification accuracy. Our data collection protocol follows established research ethics frameworks — we observe, document, and verify without interacting with platform operations or user-facing systems beyond the minimum required for endpoint authentication.
Principles
Four commitments guide every verification record we publish. Accuracy: no endpoint enters our registry without passing the full four-stage pipeline. Independence: our verification data is compiled without input from, compensation by, or coordination with any platform operator. Transparency: our methodology is documented publicly so users can evaluate and replicate our process. Safety-first posture: when verification results are ambiguous, we err on the side of caution and withhold the endpoint from the active registry until manual review resolves the ambiguity.
Research Inquiries
Researchers, security professionals, and journalists seeking historical endpoint data, methodology documentation, or phishing indicator datasets may submit inquiries through our designated channels. We aim to respond to research inquiries within 48 hours. We do not provide technical support for platform operations, account recovery, or transaction-related assistance — these fall outside our research scope. For information about how we handle inquiry data, consult our privacy policy.