The two divisions that do not line up
Sort the parts of an onion address by how expensive they are to control and you get one order. The front is cheap, the middle and end are not. Sort the same parts by how much attention readers give them and you get a completely different order. The front gets nearly all of it, the end gets a little, the middle gets none.
Those two orders are almost inverted, and everything difficult about verifying an address by eye comes from that inversion. Attention is concentrated exactly where control is cheapest.
| Zone | Cost to an imitator | Attention it receives | Use as a check |
|---|---|---|---|
| Head, first 8 | low for 4 to 6 characters | almost all of it | weak, and falsely reassuring |
| Middle, 21 to 40 | prohibitive | none | strong, if anyone did it |
| Tail, last 8 | prohibitive, and one character is fixed | some | moderate, weaker than it appears |
What a forger actually does
They pick the number of leading characters they can afford to match, which for ordinary hardware is somewhere around four to six, and they grind until they get them. Then they stop, because every additional character costs 32 times more and buys them nothing against a reader who was only ever going to check the first few.
What comes out is a string whose opening matches and whose remaining fifty characters are unrelated noise. It is not a near miss of the target address. It is a completely different address wearing a familiar hat.
This is why looking for a subtle difference is the wrong instinct. People expect a forgery to be a near copy with one character changed, because that is what forgery means in most other contexts. Here the string is not a copy at all. Past the ground prefix it shares nothing with the address it is imitating, and if you compare any twenty characters from the middle the difference is not subtle, it is total.
What follows from that
The good news in this is real. Because a forgery diverges completely rather than subtly, any honest comparison of a decent chunk of the string catches it instantly. You do not need to spot a swapped character. You need only to look somewhere the forger could not afford to control, and almost the entire string qualifies.
The bad news is that people do not look there. The check that gets performed in practice is the first four characters, sometimes with the last four added, and that check is satisfied by exactly the thing it should catch.
The conclusion this site draws, and it is a judgement rather than a measurement, is that partial visual checks should be abandoned rather than improved. Not because a longer partial check is worse, but because any partial check invites the reader to feel finished. The procedure that works is on the copying page and it does not involve reading the string at all.
Questions
Would a fake TorZon address look almost identical to a real one?
Only at the beginning. Past the few characters the imitator paid to control, the two strings are entirely unrelated, so any comparison beyond the opening shows a complete mismatch rather than a subtle one.
Is checking the last few characters good enough?
Better than checking the first few alone, and still weak. One of those characters is fixed by the format on every address in existence, and eight characters out of 56 is a small sample of the string.