short notes about this list, the tor network and not getting phished. no newsletter, no comments, no rss bloat - it updates when it updates.
Underground forums advertise SIM-swapping jobs at $2,000 to $5,000 per number, with a premium when an insider is already in place at the carrier. The pricing, the court cases behind it and the defenses that work.
Tor's money once came mostly from the US government; today it is a mix of State Department grants, foundations, companies and small donors. A look at what the project's own reports and 990s actually show.
Cisco Talos has documented a Windows infostealer that sends each victim's stolen data to OpenRouter models and asks for a ranked assessment of what the person is worth and how good their opsec is. The sample ships as a per-customer build with no attacker-owned infrastructure.
Tor bridges only work while censors do not know them, so their distribution is deliberately rationed. A look at BridgeDB's retirement, the rdsys successor, the Moat captcha, email and Telegram channels, and why bridge scarcity is a feature, not a flaw.
Adversary-in-the-middle kits relay one-time codes and session cookies in real time, but a passkey is bound to the single domain that issued it, so the proxy gets nothing to relay. A look at why the mechanism holds, where it still falls short, and how far adoption has come.
Qilin, once a small Go-based brand called Agenda, has become one of the most active ransomware operations worldwide. A look at its Rust loader, its kernel-level EDR killer, the Synnovis and Lee Enterprises attacks, and what 2,398 leak-site victims reveal.
EXIF GPS coordinates, PDF producer strings and Word author fields have ended more pseudonymous careers than any exploit. A look at the documented cases, and at what actually removes metadata and what only looks like it does.
Nucleus Market rose to second place in Agora's wake and went dark on 13 April 2016 with no statement and no seizure banner. Ten years on, the scam-versus-seizure question remains open, and its wallets sat still until 2025.
A VPN before Tor hides Tor use from your ISP but moves trust to the VPN provider; a VPN after Tor is broadly discouraged. For most users plain Tor remains the default. Here is what each chain order changes and when the extra hop is justified.
Every hour, a small, hard-coded set of directory authorities votes on a single document that defines the public Tor network. How that vote works, what it decides, and why bridges live outside it.
The darknet document trade sells two products: cheap generated ID images built for remote checks, and physical forged passports shipped by post. What open research says about prices, templates, KYC-driven demand and the operations against the workshops.
End-to-end encryption protects message content, but delivery still leaves traces: connection times, IP addresses and identifiers. A plain look at what Signal, SimpleX, Session and federated XMPP actually see, and where published disclosures back the claims.
