short notes about this list, the tor network and not getting phished. no newsletter, no comments, no rss bloat - it updates when it updates.
EXIF GPS coordinates, PDF producer strings and Word author fields have ended more pseudonymous careers than any exploit. A look at the documented cases, and at what actually removes metadata and what only looks like it does.
Nucleus Market rose to second place in Agora's wake and went dark on 13 April 2016 with no statement and no seizure banner. Ten years on, the scam-versus-seizure question remains open, and its wallets sat still until 2025.
A VPN before Tor hides Tor use from your ISP but moves trust to the VPN provider; a VPN after Tor is broadly discouraged. For most users plain Tor remains the default. Here is what each chain order changes and when the extra hop is justified.
Every hour, a small, hard-coded set of directory authorities votes on a single document that defines the public Tor network. How that vote works, what it decides, and why bridges live outside it.
The darknet document trade sells two products: cheap generated ID images built for remote checks, and physical forged passports shipped by post. What open research says about prices, templates, KYC-driven demand and the operations against the workshops.
End-to-end encryption protects message content, but delivery still leaves traces: connection times, IP addresses and identifiers. A plain look at what Signal, SimpleX, Session and federated XMPP actually see, and where published disclosures back the claims.
Tor Browser 16.0, released October 29, is the first stable build on Firefox ESR 153. It adds native ARM64 Linux support, rebuilds the settings pages, and offers an opt-in control that hides page titles from other software.
Fake "Airport_Free_WiFi" hotspots and counterfeit captive portals remain a real travel risk. Australian prosecutions for evil-twin Wi-Fi at airports and on domestic flights show what the trick harvests, what HTTPS stops, and what it does not.
Ransomware brands advertise for affiliates on underground forums and Telegram with revenue splits, rules pages and vetting interviews. The recruitment spam that follows every takedown shows where the real scarcity lies: not in code, but in operators.
Since Tor 0.4.8, onion services can demand a transparent proof-of-work at the introduction step when overloaded, queuing clients by the effort they spent. How the Equi-X puzzle and its priority queue work, and where the defense still loses to well-funded attackers.
In May 2019, the darknet news site DeepDotWeb was seized and its two administrators were charged with laundering the bitcoin kickbacks the site earned for referring buyers to markets. Prihar pleaded guilty in March 2021 and was sentenced to more than eight years in January 2022, a case that drew a line between covering darknet markets and profiting from them.
Device-code phishing tricks victims into entering an attacker's code at a genuine login page and approving the sign-in themselves, handing over a working session without a password. How the technique defeats MFA, the red flags, and the defences that hold up.
