News Feed
  • DrugHub has agreed to fully refund all users who lost money in the SuperMarket exit scam.  
  • Retro Market has gone offline. Circumstances of the closure unknown.  
  • SuperMarket has closed following an exit scam by one of the admins.  
  • The admin of Incognito Market, Pharoah, has been arrested by the FBI several months after exit scamming.  
  • Silk RoadTorhoo mini logo
  • darknet markets list
  • Popular P2P exchange LocalMonero has announced it is closing.  

The Best Buds in AUS - Medicinal Grade Goodness - DrChronicAU : DrugHub | Torhoo darknet markets

Come and get a sample of the best value buds in AUS, just pay for shipping and your very own 1g sample will be at your door!

+ NO PGRs
+ NO OVERPRICING TOP QUALITY STRAINS
+ NO BULLSHIT

Experience the DrChronicAU difference! AUS -> AUS shipping only!
It saddens me to say that some vendors are still using 2,048 bit RSA keys.
Do yourself and your customers a favor and upgrade your deprecated key.
I could just message you all directly but I hope you come across this message.
Use ECC (ECDSA/EdDSA) or, if you have to, use a 4,096 bit RSA key.
/u/SurplusNug
1 points
1 year ago*
I saw your post and I changed my PGP key. Changed to ed25519. Is this good? Sorry if this is a silly question, I am by no means a cryptographic expert. Thank you for the post.
You did a perfect job. Outstanding. You are now well ahead of the curve.
/u/SurplusNug
1 points
1 year ago
Thank you for taking the time. You are doing an excellent job keeping this place informative. I follow your posts often.
Thank you, so much /u/SurplusNug. Glad to help if I can.
/u/monolithicalx
1 points
1 year ago
Changed my PGP to ed25519 as well, however I also don't know too much about cryptography, is there anywhere you recommend that I can read up about the new stuff?
Absolutely. I'll provide you with links tomorrow. The Internet as a whole is shifting to ECC. Everything you make a bank transaction using SSL you are using ECC. RSA is slowly getting outdated.
/u/monolithicalx
1 points
1 year ago
Thank you very much!
No problem. Fantastic job on the upgrade. You are ahead of the curve at this point. More secure and faster encrypting/decrypting.
/u/monolithicalx
1 points
1 year ago
I had no idea beforehand XD.
/u/Saigoon
1 points
1 year ago
I don't think so. RSA 4096 is still stronger than ECC (ECDSA/EdDSA) and will probably be for the next 20 years, depending how the development of quantum computers and their algorithms will progress. Search Stackexchange and MathOverflow for some info about it. Read this example: https://security.stackexchange.com/questions/171308/how-to-interpret-this-statement-against-4096-bit-rsa
I wouldn't be so sure about that. The world is moving toward ECC at large. RSA is just about compounding numbers. Even Kleopatra by default is now using ECC. Along with SSL/HTTPS globally.
/u/boogieshoes
1 points
1 year ago
We're using 4096 RSA currently. Do you recommend going through the hassle of establishing a new key using ECC? We'll need to look into ECDSA/EdDSA, I know nothing about it.
It's the direction the Internet as a whole is going. Every website you connect to.
/u/boogieshoes
1 points
1 year ago
ed25519 + cv25519? Kleoptra is showing a bunch of additional options, varieties of "brainpool" and "NIST"
/u/[deleted]
10 points
1 year ago
I guess that concludes their recent issues regarding the service. If you used DNMX for any kind of service, make sure to clean those accounts and migrate your data, possibly even burn if you can. This is also a good example of what happens to services that rely on legal loopholes to operate. Use remote infrastructure and do not rely on a single provider or service, or you risk getting raided.

For those who did not encrypt emails, let this be a major reminder of why you always should.
All wisdom here from /u/Bluefin

Let his reminder impress on you the value of self-encrypting messages.
/u/Varixmar
1 points
1 year ago
i hope you don't mean relying on the email provider to encrypt the messages with a provided key or etc. same thing with markets as soon as you give them control over that they can easily turn it into a malicious system of de-anonymizing everyone one by one with just a simple swap of keys on the backend if feds get control or admins go rogue and want to start a blackmail scheme.
/u/socat2me
3 points
1 year ago
Yeah he meant self-encrypting messages as in always handle message encryption yourself.
Exactly as /u/socat2me wrote it. Encrypt it yourself, rather than by letting their automated way do it for you.
/u/HEISENBERG07
1 points
1 year ago
Yeah /u/Bluefin I agree with you but DNMX Wont allow you to do any shit unless you Buy their Premium...Leave Deleting the Account they dont even allow to Change the password tho..........
/u/[deleted]
1 points
1 year ago
That is just greed talking.
/u/KyleKlemons54
1 points
1 year ago
Thanks Bluefin but I never used DNMX much anyhow - no regular communications - nothing.
But yes. Do encrypt your emails and even the files inside of them.
/u/him
2 points
1 year ago
if the server hard drives were encrypted and the feds powered down the servers to take the drives surely there would be no data to recover? i've heard feds will just walk in and cut any cables that are plugged in that prevent them from physically taking the server
/u/Varixmar
1 points
1 year ago
you will never know in this situation unless you have someone inside during the raid so its all speculation but like i've told others you shouldn't trust the admin anymore and burn anything related to DNMX. plenty of other options out there, don't risk your freedom because of loyalty to someone who could now be easily compromised.
/u/samwhiskey Le Commandant
1 points
1 year ago
It's really according to what they are after. Portable power supplies can keep it powered up until it reaches the lab.
/u/[deleted]
1 points
1 year ago*
It is a widespread misconception that the police simply seize servers and then power them off. In reality, law enforcement agencies make every effort to preserve the integrity of the data on the server. Shutting down the server can potentially cause data loss, especially if there are so-called 'wipescripts' that are active and automatically executed upon the server's startup. Such risks are unacceptable given the importance of data integrity in ongoing investigations.

Law enforcement agencies have specialized tools that allow them to connect their own power supply to the server, enabling them to disconnect the server from the data center's power source. This enables them to safely transport the server to their forensic laboratory while keeping it operational, preserving essential data and investigating potential traces of criminal activity without disruption.
/u/him
1 points
1 year ago
surely somebody at some point has filmed the feds during one of these raids. that would be interesting to see
/u/squeaky_clean_sanchez
2 points
1 year ago
Email is fundamentally insecure and requires active steps to make it secure. Active steps that people get lazy about and before they know it they're routing incriminating plain text through the clearnet and leaving a trove of info on someone else's machine.
Xmpp/jabber with OTR is all anyone needs for sensitive communications.
"Email is fundamentally insecure" — absolutely. Email is an insecure form of communication. And, just as you mentioned, it "requires active steps to make it secure". Very well stated, /u/squeaky_clean_sanchez
/u/psychonut
1 points
1 year ago
XMPP is "fundamentally insecure" in the same way that e-mail is. You need OMEMO or OTR for XMPP just like you need PGP for e-mail.
/u/FEME
1 points
1 year ago
people send shit without omemo ?
/u/[deleted]
1 points
1 year ago
Crazy people.
/u/psychonut
1 points
1 year ago
Yes. OTR is still very popular and sometimes people use neither option.
/u/garlicmaster
2 points
1 year ago
200GB emails backup'd sounds worrysome in and of itself.
Few other details also sound somewhat sketchy.
Just goes to show to never ever trust the source, regardless of anything.

Treat everything like it's compromised from the get go.
by /u/HeadJanitor • 6 hours ago* in /d/OpSec
Exactly. We are, after all, dealing with the darknet. We can't forget to include our environment into the bigger picture. All things on the darknet will come and go.
/u/[deleted]
2 points
1 year ago*
[removed]
/u/Varixmar
1 points
1 year ago
they coming for your ass if you didn't encrypt everything bruh, i'd start preparing a kit bag ASAP.
/u/[deleted]
1 points
1 year ago
[removed]
/u/Varixmar
1 points
1 year ago
unless you are an informant for them with the amount of money you are talking the IRS would love to come after you alone. we are talking illegal funds alone in proceeds of what averages out to be $11904.761904762 on a monthly basis, especially if you are low hanging fruit and didn't encrypt or launder the money properly. these government agencies are a business like any others and thats good return on investment for them.
/u/worldstolenmall
2 points
1 year ago
is it honeypot?
/u/Varixmar
1 points
1 year ago
yea i honestly wouldn't trust anything related to the admin now that they had a warrant for the servers and unless he is willing to do hard time for contempt this could involve cooperation with means if he has the keys to the LUKS encryption to hand them over and who knows what else depending on if its child porn or weapons trafficking to then transfer all ownership.
/u/feisthedevil
1 points
1 year ago
How could it be a honeypot if the admin already said outloud that the cops took the servers?
/u/JohnArcher
2 points
1 year ago
How much you wanna bet he gave up credentials in exchange for not getting arrested
/u/Varixmar
2 points
1 year ago
posted same response earlier. do not trust anything from him onward if you want to be extra cautious.
/u/Camount746
2 points
1 year ago
What are the best alternatives to DNMX?
/u/Attitudehikster
1 points
1 year ago
Me too. What's everyone else using then?
/u/FEME
1 points
1 year ago
try services in switzerland highly unlikley they will respond to request to hand over data. and STILL encrypt.
/u/Bekhighlov
1 points
1 year ago
Better yet use servers in questionable countries that wont help the country you live in!
/u/FEME
1 points
1 year ago
switzerland wont comply with any requests. it would really have to be something major. they have very strict laws in regards to privacy
/u/Gambetta
1 points
1 year ago
[removed]
/u/FEME
1 points
1 year ago
care to expand? thats a bold claim. given their history.
/u/Gambetta
1 points
1 year ago
I know. sorry. I should not even post if I am not willing to explain.
Maybe it was major in their eyes? no.. maybe they just wanted to spook my associate
It's something I can't put my finger on if that is the phrase to you.
/u/FEME
1 points
1 year ago
i mean its in their constitution. you have to go through courts to just get the pleasure of no most likley. and that would be news worthy imo. the have newer laws pertaining to money. but communications still afford it being mostly illegal to be shared with foreign countries. there is no we are a private company we trust america here ya go. there are exceptions however. and as i said they would require a court order. and not hidden secret court orders either.
/u/Camount746
1 points
1 year ago
Thanks!
/u/KyleKlemons54
2 points
1 year ago
Well thankfully I never used DNMX on the regular. Sad that this had to happen, but oh well, it happens. Sucks when it does - but sadly it does happen.
/u/Gambetta
1 points
1 year ago
B00000000000m
/u/Gambetta
2 points
1 year ago
Another reminder to use + PGP or any other innovation you believve in for your secure.
/u/rasclatbunn
1 points
1 year ago
/u/HeadJanitor, that basically means that he made himself cooperate ( in case if this message is indeed from him, otherwise noone knows exactly
In this Bohemian day and age, who knows what of anything. Sad state of affairs. I've actually never used DNMX.
/u/[deleted]
4 points
1 year ago
I suppose he would have to cooperate depending on what jurisdiction he is in. We definitely will hear about it in official statements in some time. Until then, god speed to the admin. The scene is very sad if it's come to this. Another reminder of why you should not trust empty words from admins saying they will never cooperate.
/u/HumanPie
2 points
1 year ago
Most definitely. Will likely hear it in the upcoming busts related to the compromised data. Wouldn't be surprised is this was part of a coordinated larger operation as well.
/u/Varixmar
1 points
1 year ago
+1 this is too true, they probably targeted DNMX for a reason that we will soon find out in the coming weeks or months in a large scale bust.
/u/FEME
1 points
1 year ago
lol bs hardened criminals fold 9 time out of 10 people watch to many movies to think any one is going to prison for any one
/u/[deleted]
1 points
1 year ago
Maybe but that doesn't make a lie okay. This guy fucked up big time and now he wants to make a new one? No thank you.
/u/FEME
1 points
1 year ago
if he was raided 100% he gave up everything. they wouldnt even of had to ask twice.
/u/[deleted]
1 points
1 year ago
Indeed.
/u/theleoneo2
1 points
1 year ago
forreal.....
I learned the hard way!
/u/FEME
1 points
1 year ago
why ? i mean its not like having a service that only caters to a specific user could be a bad thing? who needs hiding in plain sight. thats why cartels keep all their money in secret banks with names like cocaine profits be fat and meth to gold bank these banks can blend so easily and would never give the feds a hard on.
/u/CodeIsLaw Master Root
1 points
1 year ago
I wonder if any Market admins used a DNMX email to purchase their Servers for the Market.
/u/[deleted]
1 points
1 year ago
That would be very funny for law enforcement. They would definitely have some investigations to do.
/u/bernard
1 points
1 year ago
I curious to which markets will stopped 😂
Time and again you people have been warned to only use Google gmail. The only organization that is too big for LE to take on. J/K

Plot twist: LE not involved. This is a campaign to gather funds for new more powerful servers. This donation wallet address and BTC no less!!


Great topic!!!!
/u/miner21 P
1 points
1 year ago
Well shit that really sucks....
/u/onionmann3
1 points
1 year ago
This is bad news, I now have to nuke my dnmx emails
/u/grtooemrgroomer
1 points
1 year ago
Fuck.. .GG no re.
/u/lsdnigg
1 points
1 year ago
Bro all my business emails
/u/[deleted]
1 points
1 year ago
This is why I don't use any email service that says they are "darkweb" or "private" lol.
/u/Varixmar
1 points
1 year ago
it really doesn't matter the government will come for any and all as soon as its part of an investigation worth the return on their investment. like everyone else says all you need is a non-javascript email provider and PGP encrypt all material
Not surprised... nothing is safe, unless you treat it as disposable. The regime hates guerillas, snipers, and counterespionage.

The idea that you can have a persistent account that is secure is very misconceived. The most secure way of using any communication medium is to use it only once, and in only one direction, and of course, to not put traceable data inside any correspondence.
(Wrong reply-to, sorry).
/u/SOUFFLE
1 points
1 year ago
it took me a while to realize this, but i agree you're absolutely right.
/u/clockwerk
1 points
1 year ago
Interesting, any other Services/sites etc.. this Firm provides that Anyone is aware of?
I never heard of the dmx Email
/u/jethro23
1 points
1 year ago
There is a reason we PGP encrypt all sensitive data. Even doing so its good to switch up email accounts/providers every so often
If there is a place that contains an information it can be stolen. Encryption of emails is a must.

Besides the encryption be aware that email leaks all metadata even if encrypted - who, with whom, when, how often, for how long...one communicated with others. This will be leaked to the adversary too. Depending on your security posture it can be more dangerous than the content of the messages.

Adapt properly.

For higher security requirements use more modern solutions.

Stay safe!
There are several ways to eliminate metadata:

1) Keep all your inboxes, outboxes, etc. CLEAN! Now, mind, there is still the problem with backups, but this is a start, at least.

2) Nymservers/remailers eliminate metadata and ensure all incoming email is PGP-encrypted.
1) Keeping inbox and outbox clean is not going to work if the service logs it. They can say they don't but you cannot prove it.
2) Nymservers, remailers and other solutions can help but there are some necessary attributes of the secure communication that is otherwise available - PFS, backward secrecy, no identity and others.

It can be used but one has to understand that it is limitations and have it covered in their OpSec.
Anything I say has no value when compared to /u/Gorgon. Please take your time to read the insights he shares.
/u/hackerG
1 points
1 year ago
How to encrypt our emails in darknet ?
PGP. Use ECC (ECDSA/EdDSA) when making your key.
/u/hackerG
1 points
1 year ago
great, but Telegram is safe? there's away to create an anonymous account ?
I wouldn't consider Telegram "safe".
/u/hackerG
1 points
1 year ago
but some hackers communities used it, how do they to protect them?
There are dealers on street corners all over the world. They make their money and run and don't think of the future. Just how much they can grab in the moment and be gone in the next moment.
/u/JohnArcher
1 points
1 year ago
Where did the message originate from? Who is the admin of DNMX and how do I contact him? If you are reading this please kindly delete e-mail address johnarcher@dnmx.org, thank you

XD
Their Onion.

I just checked — the message in gone. The site is blank.
/u/[deleted]
1 points
1 year ago
Congratulations! You just bumped your email account up in the officer's "to read" pile. By asking for it to be deleted, they'll figure there must be something good in there worth looking at!
/u/bernard
1 points
1 year ago
jeez :D OPSEC?? WTF MAN?
/u/charliemurpha
1 points
1 year ago
I don't think LUKS have ever been broken (if a strong password is used). Or am I wrong?
/u/fohshizzle2
0 points
1 year ago
> I have a backup (200GB+) and will give access back to all 200,000 users to their emails.

lmao
Seriously! He'll mail us a flash drive with a zip file of all of archives. I'll go wait by mailbox for this.
/u/fohshizzle2
1 points
1 year ago
It is not about the filesize which is completely neglectable but rather "plausible deniability" lol
And the ludicrous concept of getting in contact with each and every 200,000 member to give them their confiscated data.
/u/Bekhighlov
1 points
1 year ago
Pure insanity. I wonder how they found their servers and what will come of all this.
/u/[deleted]
2 points
1 year ago*
Despite the challenges, law enforcement agencies and investigators often leverage techniques reminiscent of those employed by hackers to identify perpetrators within the dark web. These methodologies may involve meticulous analysis of traffic patterns, covert infiltration of criminal communities, or the exploitation of software vulnerabilities within darknet access tools.

or

Utilizing a BTC address for donations to cover server costs. Law enforcement simply follows the money trail.
/u/holycash
1 points
1 year ago
Sorry....I sent you a stupid DM re: backed up emails. Who is the person who was overseeing DNMX? I want to reach out and at least make an attempt to see if his backup claim is true. Can you DM me his /u/ ??
I have no idea who he is but I'm sure even attempting to make contact with him at this point will not be a sound decision. Sometimes you have to learn to walk away.
/u/him
2 points
1 year ago
i think it would be funny if he simply posted a torrent backup of the server hard drives and let users sift through their own data