The onion address, and the ritual around it
The market publishes exactly one address the world can use; everything else is issued privately to accounts. That single public string is the highest-value phishing target on the entire network, so treat it like a bank detail: copy, compare, and only then connect.
http://drughuberjxfrxtlk2cystdz4jvogmc3lsnk5drvwx2nfi63ou2r2kid.onion/
Four checks before you trust any DrugHub link
1. Length and alphabet first
A v3 onion is exactly 56 characters from the base32 set (a–z, 2–7) before .onion. Legacy
16-character v2 names were deprecated in 2021 and modern Tor will not connect to them. Any “DrugHub”
link shorter than 56 characters is fake by construction — no further analysis needed.
2. Compare character for character
Match the address against the block above, saved from this page over a connection you already verified once. Bookmark it inside Tor Browser; never retype it. Phishing clones succeed almost entirely through one transposed character.
3. Verify the signature, not the screenshot
Staff announcements are PGP-signed. The key fragment from the signed key-facts post is 2gj6 w49X MbMf … jfUF AmhQ. A link posted without a verifiable signature is gossip, not news. If a known-good signature suddenly “fails”, suspect your own outdated PGP client first — the market requires modern EC-key-capable software and rejects legacy tooling.
4. The sign-in message is the final lock
DrugHub login is passwordless: your PGP key is the credential. After you decrypt the challenge and submit it, your personal sign-in message must appear in the top navigation bar. A clone site cannot know it. Missing, blank or different = phishing; close the tab and enter nothing further.
Why there is no mirror list
DrugHub runs unique private onions per account (two for vendors), bound to the session, never published. Public mirrors sit behind proof-of-work and take the DDoS traffic so private links don't. Consequently any page that lists “DrugHub mirrors” — including, hypothetically, this one — is a phishing indicator. The only authoritative sources for links are PGP-signed announcements inside the market and your own saved private addresses. Eligibility for a private mirror: 8+ completed orders in 60 days, clean record, active key (announced 2026-09-21); sharing one is an instant permanent ban (2026-08-26 terminations).
| Class | Who | Protection | Attack surface |
|---|---|---|---|
| Master onion | Everyone | PoW on public mirrors | DDoS + cloned front pages |
| Private per-account | Qualified buyers; all vendors (×2) | Session-bound, unpublished | Sharing/scraping = ban |
| “Mirror lists” anywhere else | Nobody — they don't exist | None | Phishing by definition |