Access and phishing

Every visit to TorZon hits a server-side anti-DDoS waiting room before anything else. A static access-queue page holds you for a few seconds to a minute depending on load. It is flood control: bots that do not respect the queue cannot hammer the login captcha behind it. It is mildly annoying the first time and completely normal by the third.

The mirror set is seven v3 onions running concurrently, the deepest pool on the shortlist. That is a lot of redundancy, and it is the other half of the resilience story alongside the queue. Keep the signed list. Rotate across it freely when an address is slow.

The queue changes the rhythm of access but not the rules. Verify the address against the signed list, cross-check the header, and treat any address not on the list as hostile no matter how close it looks.