An onion link is a Tor-based address, usually ending in .onion, that routes traffic through the Tor network and hides the location of the service. It is not a normal public web address: the server’s IP address is obscured, and users connect through layered encryption and relay hops. This makes onion links useful for anonymity on both sides of the connection.
In cyber security, onion links matter because they are often used to host services that are difficult to trace, monitor, or remove. Criminal leak sites, command-and-control panels, and private marketplaces may use them to publish stolen data or coordinate extortion. Defenders should treat an onion link as a strong indicator of hidden infrastructure, then collect it for analysis, preserve evidence, and assess whether the associated service exposes stolen files, negotiation pages, or other attacker tooling.