John Marsh 
Hello everybody, John Marsh here the admin & owner of Darknetstats. Today i am back again with yet another story where we will be revealing the biggest scam currently happening in the darknet world. As you guys already know that we have become the leader of darknet related news and information within a short period of time. Our news have been published in the biggest news magazines including crowdfundinsider and databreaches.net. We were also the first ones to break the news of Nightmare market’s exit scam. It wouldn’t have been possible without your continued support and appreciation. For this we are thankful to you and we hope you keep supporting us in the upcoming future.
Today we are breaking the story of the biggest scam that is going on in the darknet world. We will be giving you an in depth look at what is happening behind the scenes of the three different darknet entities, How they are working together, supporting one another and How they are connected with Full proofs including screenshots, Forum posts and Pgp verifiable messages.
Yes, you guessed it right. As the title says we are talking about Darfail (a link sharing resource), Nightmare market and Dread (a reddit styled discussion forum). I will start the article from our hack then continue on to connecting the dots in the end so you guys can get the clear idea about this evil enterprise. This will be a very long post so i need you to take your time, relax and read every part of it to fully understand this article.
Hacked Us Again!
On 18th june i was busy browsing dread forum as usual when i got a pm from a notorious hacker (well not so notorious) godman666 in which he claimed to have got my ip and my website’s ip address , Asked me to get on jabber for a detailed conversation.
Strange but anyway i went on jabber and started a chat with godman666. So his claim was darkfail is run by empire market and they paid him (godman666) money to hunt me down. I asked him for a proof but he was hesitant to provide any. His main purpose was to extort a sum of $350 if we wanted not to be hacked by him.
Apparently godman666 was making huge claims like he doxxed variety jones (silk road admin), alpha02 (alphabay admin), verto and kimble (evolution market admins) which we already knew he didn’t but anyway we kept on talking.
He kept on telling how great he is and pointed to some articles mentioning him in the past.
Last time we got hacked we only got picture and email proof but this time i wanted to document everything in case we got hacked then we must have some kind of pgp proof so i asked godman about a pgp message as a proof. At first he was hesitant but we assured him that we will not share his messages. The trap was set, he gave us a pgp signed message.
We got the pgp signed message after going back and forth about the message body and the pgp key. In the end we successfully got what we wanted.
After that we promised to arrange the funds and asked him that we needed sometime. So he agreed and gave us 2 hours. Obviously we weren’t going to get blackmailed by a hacker and he wasn’t getting anything. We ended the conversation after that.
If you need the full conversation in written format then it can be found on
Link: pastebin.com/r5r9edGW
The Proof
As said earlier we tricked godman666 into giving us a pgp signed message as a proof. So now we will share it with you, please keep in mind that the message written here is what we demanded him in the screenshot above.
The above signed message can be confirmed by anyone using this link. dreadditevelidot.onion/u/godman666/pgp
This is the offical pgp key godman is using and it can be confirmed by anyone going to his dread profile and clicking on pgpkey located at the side bar.
A day passed by and then he contacted us again demanding the payment. Of course we weren’t giving him anything so it made him furious and we ended up getting hacked. It was embarrassing that we got hacked the second time but thankfully we found the vulnerability very quickly and we were back up within hours.
The Celebrations On Dread
As soon as we got hacked godman666 started a thread on dread about us and posted details of the hack with a thread title ” Bitcoin … super ..buy Ip address : 185.100.87.189 “. Please do keep in mind that this is not our ip address and we aren’t affiliated with bitcoinsuperbuy. I don’t know why he always think that we are bitcoinsuperbuy??? :/
Guess what? the mods are celebrating. One mod witchman05 said
Oh, whoopsies! My delete button isn’t working for this post! Such a shame!
By this he is saying that normally i delete all the posts that talks about or have the word darknetstats in it but this time my delete button isn’t working meaning that i wont delete this this thread. Here is the link to the post
Link: dreadditevelidot.onion/post/f2fe19753e78089cbff7/#c-fbcf7a781fc9d12d7d
The reaction of godman666 or darkfail was understandable but why were mods happy by our site getting hacked? We will be analyzing this shortly.
Still Believe Darkfail Is Innocent?
We did a huge effort and after taking time of more than a month, we are writing this article. This is not just an article, its a pure research that we did to gather the facts for you. When a hacker admits to hacking a website, you think this is the first website he hacked or you think this will be the last one? How about i show everyone darkfail admitting to hacking a website publicly? Here it is with the title ” Hacked a phishing site. Dark.fail is our only valid link! ”
Link: dreadditevelidot.onion/post/99287b8967027f55d2c8
If you have ever used “Darkfail” anything… or anything other than “dark.fail” exactly typed into your browser: reset all of your passwords and enable 2FA immediately (using links from my real site!).
I was able to take down darkfail dot com today but suspect they will be back. It’s better that you just don’t even go there to not build a bad habit.
Dark. Dot. Fail. Our name is our URL. sheesh.
Our only valid Tor link is darkfailllnkf4vf dot onion.
Be safe out there.
Darkfail, Nightmare & Dread The Connection
Now its time to give you guys a detailed overview of the connection between these three entities. You must read this section very carefully because i am going to touch all the fine details that will make this connection extremely clear. I’ll breakdown this section into three parts which will show the relationship between these one by one and in.
1: Relation Between Darkfail & Dread
As you guys already know that darkfail hacked us and we posted a detailed article about this. That hack was done by darkfail directly and they took full responsibility of it but this time they sent Godman666 to hack us. So darkfail and godman are connected but how is darkfail connected to dread? Godman666 is behind Dread and is a member of their team. Here is the proof, remember in the previous section “The celebrations on dread” we talked about how happy dread mod/admin was when our site got hacked. In the moment of happiness “witchman05” went ahead and said
You know Gangsta’s Paradise, right?
Their new thing is a clearnet, Cloudflared site called “DarknetStats”, and another one, a market, called “BitcoinSuperBuy”. Considering this guy is a paedo, a fent-shipper, a scammer, a spammer, and an all-around cunt, we’re taking that shit away from him.
He shouldn’t have pissed me off.
Focus guys Focus. Read the lines in bold letters ” we’re taking that shit away from him. ” By “We” he means darkfail and godman666. Link to the thread is posted below. Its a very interesting thread and you’ll find more clues there.
dreadditevelidot.onion/post/f2fe19753e78089cbff7/#c-fbcf7a781fc9d12d7d
2: Relation Between Darkfail and Nightmare
We were the first ones to report the nightmare market’s exit scam. The news quickly spread and lots of other resources started to report on this development. The strange thing was that darkfail was totally silent at this situation. They didn’t post any “Warning” signs on Nightmare page and said nothing on their dread page. The sole purpose of their site was to keep people safe from scams and when the time came they went totally silent. One day passed by, 2 days passed by and on 3rd day when the pressure kept mounting and lots of threads on forums calling darkfail to explain why they haven’t put warning sign in front of Nightmare page a strange thing happened. Witchman05 (dread admin/mod) came out and told everyone that darkfail is on vacation and will post warning sign when he comes back. This post made users furious and lots of them started to suspect that darkfail was collaborating with nightmare to maximize the profits.
After 5 days darkfail broke silence and told everyone that he will put some kind of warning about Nightmare on his website. Which he did but it was totally a vague warning without even in bold letters and place not in front of the market but at a place where no one will notice. This move did generate a users backlash and at the the time of writing around 50 to 60 threads have been created accusing darkfail of collusion with Nightmare.
Who is Behind Them & What’s Their Purpose?
In our research we came to the conclusion that this is not the work of a single individual and we believe this is a group consisting of upto 5 members. We consider this group very dangerous because they are very smart, equipped with a wide range of skills and they work with coordinated efforts together. The strategies they devise are highly complex and can only be from a team of highly skilled individuals or Law enforcement. Here is some useful information about them.
- They created dread forum the next day when reddit banned all the darknet related subreddits. Purpose of Dread: 1. By having a discussion forum owned by them, they can easily silence their competitors just like what happened in the case of samsara when they intentionally voted down all their threads and started a coordinated negative campaign against them. 2. They can upvote their own markets and create a fake hype about them to make them successful.
- This group created darkfail after the downfall of deepdotweb. Purpose of Darkfail: The purpose of darkfail is simple which is to control the link distribution system on darknet. They will have the authority to list or unlist a market on their website.
- They possess wide range of skills from hacking, pen testing, Web development to data scraping and phishing. You can read about godman666 bragging about how he used reverse proxy to phish empire users on dread or darknetlive. Link: dreadditevelidot.onion/post/7457a0c76d78d1f0858a Link: darknetlive.com/post/empire-phishing
- They work together and you can find them online most of the times on different forums like thehub, dnmavengers and reddit. They almost instantly react whenever someone writes against them. They also act as pr machines for their own resources and post different threads to create a hype and good image of them. You can easily test them out by writing something negative about them on reddit or some other forums and see how fast they react. Dont forget to check these accounts post history that will reveal a lot about them.
As you can see we have successfully proved the relationship between these 3 entities. Now its time for you to go ahead and verify/crosscheck these facts so that you know whats going on here and its your responsibility to share it with your friends and colleagues so that they can be saved from this scam. That group also have more markets too, we used the services of a famous pentester which tested more than a dozen of markets and came to the conclusion that apollon, Dreamalt and a new etsy themed market named Nirvana Market are owned by this group. He said “they are using the same code for all of their market, the only thing they change is front end design which is very easy and doesn’t take much effort”.
We have spent so much time, effort and resources in this research. It wouldn’t have been possible without your continued support. I thank all the community for your love and support. I promise me and my team will keep bringing you exclusive insider content and will never let you down.
Thanks and Good day – John Marsh
