An onion address is a Tor-based web address used to reach services on the hidden network. Unlike a normal domain, it does not resolve through public DNS and is designed to conceal the server’s real IP address and hosting location. Onion addresses usually end in .onion and can only be accessed through the Tor network.
In cyber security, onion addresses matter because attackers often use them for leak sites, command-and-control panels, anonymous marketplaces, and file drops, making takedown and attribution harder. Defenders also use onion services for privacy-preserving communications and to monitor criminal infrastructure without exposing their own systems. When a leak-site listing includes an onion address, it often signals an attempt to host stolen data or extortion content behind layered anonymity, reducing the chances of direct blocking while still allowing victims and investigators to verify the claim.