Transparency

Our onion mirror

xmr.club is reachable as a Tor v3 hidden service. Always verify the address below before connecting — phishing onions are the #1 risk of advertised mirrors. We publish the same fingerprint via the Onion-Location response header so Tor Browser auto-suggests it.

xmrclubummbi7y3numnwvdxvh6rrpuvidsilmj2ntd5wbygqyixskaad.onion

First six characters of the onion are vanity-mined (xmrclu). The remaining 50 are cryptographically determined by the public key. Mismatched prefix = phishing. See how to verify an onion mirror for full operator-disclosure cross-checks.

Editorial control

• One curator, plus a small advisory group of long-time privacy-tools users. Reach the curator via @xmrclub_bot on Telegram (messages are forwarded to a private team channel).
• Every grade is signed off by the curator after end-to-end testing — signup, payment, withdrawal.
• No anonymous contributor pipeline. Submissions are reviewed before listing; rejections include a reason.
• Every grade change is logged to the public /audit feed.

Funding

• Affiliate links on outbound /go/<slug> redirects. Where the program exists, the link carries our referral.
• Sponsorships via /sponsor. SPONSORED chip. Bubbles placement, never grade.
• kyc.rip swap aggregator revenue (upstream engine affiliate cut — no markup added to user quotes) feeds the same budget.
• No paywalls, no premium tiers, no newsletter monetization, no scraping fees.

Products operated by the curator

The curator operates other privacy-tooling products that may appear in this directory or be referenced from guides. They are reviewed on their own merits using the same rubric and chipped where listed.

• kyc.rip — no-markup swap aggregator. Listed under exchanges/kyc-rip-aggregator.
• uPay.rip — USDT payment gateway.
• walls.rip — private messaging + SMS/Mail tooling. SIM products may appear under /sims.
• stables.rip — stablecoin tracker.
• disperse.rip — USDT batch disperser.
• 404.cash — merchant point-of-sale.
• jiayou.rip — TRON energy market.

Operator-built listings are explicitly flagged. They earn placement the same way every other entry does — end-to-end test, rubric score, audit-logged grade.

Conflict-of-interest policy

• Affiliate-bearing /go/ redirects carry a UTM identifying xmr.club as the source.
• Operator-built products are chipped and clearly labelled in editorial notes.
• Any sponsor relationship beyond the standard sponsorship slots is disclosed inline on the listing.
• If a provider sponsors and is then found to have lied about KYC posture or operational practice, the listing is downgraded or removed regardless of contract.

Verification cadence

• Daily probe of every canonical URL — /status.
• Daily onion-mirror probe via cloakbrowser — /onion-audit.
• Per-listing re-verification target: yearly. Entries past 18 months get a one-grade downgrade.
• Freshness board: /freshness.

Refusals + warnings

Providers found to KYC after deposit, freeze user funds without due process, or operate confirmed phishing / exit-scam patterns are refused or kept warning-listed. The ChangeNow warning entry is a public example. We err toward warning-listing rather than silent removal so context isn't lost.

Your data

• No analytics, no third-party scripts, no cross-site cookies.
• One cookie: xmr_theme stores your dark/light preference. Nothing else.
• /ask sentences are SHA-256 hashed and rate-limited; the normalized text is logged anonymously to seed /content-gaps. No IPs, no fingerprints.

Tech stack

For the runtime, frontend choices, and operating cost behind this site, see /colophon. Tech-stack transparency is part of the same trust story as funding transparency.

Contact

Concerns about a specific listing, sponsorship, or disclosure — DM @xmrclub_bot or @xmr_club. Corrections are logged to /audit with reason.