Fake tracking links: the parcel scam built for impatient buyers
A text says your parcel is stuck. The link looks like the postal service. Here is how fake tracking pages harvest cards and addresses, and how to verify safely.
Security
70 postsshort, practical notes about not getting phished. no fear mongering, just the checklist.
latest notes
newest firstDead drops and paranoia: what the Hydra-era kladman model teaches about security trade-offs
Hydra's courier dead-drop system moved secrecy into city parks and stairwells. Its story is a case study in why too much operational security can be as dangerous as too little.
Buyer Opsec Foundations: The Minimum That Actually Matters
Most buyers are not caught by elite hacking. They are caught by reused usernames, linked wallets, and unencrypted phones. Here is the boring baseline that decides real outcomes.
Device security before Tor: your browser is not the weakest link
Tor cannot protect a compromised device. Why OS updates, disk encryption and malware hygiene matter more than any browser setting before you connect to the network.
Tails, Whonix or just a VM: honest answers about isolation on Tor
Tails forgets everything, Whonix refuses to leak, and a plain VM only contains. What each Tor setup really protects, where each fails, and who should run which.
Zombie credentials: why old password dumps still fuel account takeovers
A password stolen in a 2013 breach can still empty your inbox today. Inside the combolist economy, credential stuffing at scale, and the true cost of reusing one password.
Scam Warning Lists: Who Maintains Them and When to Trust Them
Scam warning lists look authoritative from outside. Who maintains them, how reports get verified, and where they fail explains why readers should treat them as evidence, not verdicts.
Link directories and dark.fail: what verified onion lists actually prove
What link directories like dark.fail actually verify, how PGP-signed mirror lists work, where they fall short, and how to build a verification habit that survives.
Verifying software downloads over Tor: checksums and signatures done right
Checking a hash against the same server that served your download proves nothing. Here is how to verify software over Tor properly: signatures, key fingerprints and a little patience.
Threat model thinking: deciding which protections you actually need
Security advice tells you to do everything. A threat model tells you what matters for you: your assets, your adversaries, their capabilities, and where effort is wasted.