Why Verification Matters
Phishing is one of the most common threats to darknet marketplace users. Attackers create sites with .onion addresses that look nearly identical to the genuine market address — often differing by a single character. These phishing sites steal your credentials and drain your deposited funds.
CannaExpress publishes signed mirror announcements using PGP cryptography. By verifying the PGP signature on any mirror update, you can confirm that the address came from the genuine CannaExpress administration key and not from an attacker.
The CannaExpress Verification Process
When CannaExpress updates its mirror list, the administration team publishes a PGP-signed message on Dread (the darknet forum) and in the market's official announcement section. The signed message contains the current onion addresses and a timestamp.
To verify the signature, you need the CannaExpress administration public key, which is available directly from the market's signed-in area and from the Dread announcement thread. Import this key into GPG and verify any mirror announcement before trusting the addresses it contains.
Never trust unverified addresses. Even if an address appears on a forum post, search engine result, or friend's recommendation, cross-check it against the PGP-signed announcement before using it.
Verifying with GPG
Once you have the CannaExpress public key imported into GPG and a signed announcement, run the following command to verify the signature:
gpg --verify cannaexpress-mirrors.txt.asc cannaexpress-mirrors.txt
A valid signature from the CannaExpress key will show Good signature from "CannaExpress Market <admin@cannaexpress>" with the correct key fingerprint. A bad or missing signature means the message may have been tampered with — do not use the addresses it contains.
Checking a Mirror Live
Before entering any credentials, perform a basic sanity check on any mirror you are about to use:
- The address matches the latest PGP-signed announcement exactly, character by character
- The market loads over HTTPS within the .onion address (look for the padlock in Tor Browser)
- The site prompts for PGP 2FA at login — genuine CannaExpress always requires this
- The market's own PGP key is available in the account section and matches the known fingerprint
Reporting Fake Mirrors
If you encounter a phishing mirror or site impersonating CannaExpress, report it in the official CannaExpress thread on Dread. Include the fake onion address and a brief description of what you saw. The CannaExpress team will publish an updated signed warning.