Part 1: Introduction
Hello community, it has been awhile since I have been here. There have been a multitude of reasons as to why I haven’t been active here in roughly 2 years.

I thought I’d stop by and provide Dread with the ULTIMATE darknet OPSEC guide. Having been on the darknet on and off for nearly 13 years, I have seen a lot, learned a lot, and can see clearly that both the clearnet and darknet have changed drastically over the last decade. I’m sure many of you have read OPSEC guides, as there are a plethora of them out there. However, a lot of the information in those guides are at least, somewhat outdated (or entirely). For instance, law enforcement has better technologies and strategies than ever before. New techniques for unmasking and surveilling users has been developed by researchers. AI (particularly Large Language Models and advanced algorithms) has been a digital can of worms that cannot be closed and can only evolve; highly versatile technologies that serve as a multi-edge sword that can de-anonymize you or help you cover your tracks better than ever before. There are also other emerging technologies like quantum computing that might make things more complicated for darknet users to stay anonymous. With quantum computing, a lot of people say “well, they’ll just make encryption much stronger so quantum systems won’t be able to crack it”, while that is mostly true and people have already begun doing so, there are a lot more aspects of these technologies than just that that need to be taken into consideration. I plan to cover this much more later on.

In this guide, I will start with the basics and work up to the more advanced concepts. Not only for newcomers, but even seasoned veterans need a brush up on the basics every now and again.

Part 2: Software Basics

For this part, I will be laying down the basics of modern darknet OPSEC. I’m sure most of you understand how the tor network works; it basically encrypts your data, routes it through several computers (nodes) around the world, and when it leaves the final computer (also known as the exit node) it decrypts it so it can fully interact with its destination if you are using the clearnet (the normal world wide web). The downside to this is the fact that if you’re not using HTTPS or other forms of encryption, the exit node can see all of your data fully unencrypted. Even with HTTPS, it can still see what websites you are visiting. Now, if you are using tor .onion websites, your data remains encrypted through the entire process and you don’t have to worry about exit nodes eavesdropping. It should be noted that many tor nodes, entry, relays, and exits, are operated by law enforcement or malicious groups who are hellbent on de-anonymizing users or stealing their sensitive data. If you connect to the tor network and your circuit (all nodes) are operated by the same organization, that organization can see your IP address through the entry node, and can see what you are doing through the exit node.

When taking into consideration of what I mentioned above, it should be obvious that using a VPN before starting tor is absolutely essential. A virtual private network usually encrypts your internet data and routes it through one computer before being decrypted as it reaches its final destination.er VPNs are for privacy, not anonymity. Their providers are usually companies that must comply with laws and regulations. Even when their providers claim not to keep logs, their systems will always produce some kind of logs (it’s just how software and operating systems work) and regardless of what kinds of data is being logged, it could potentially be used to de-anonymize or track users. Even the most microscopic forms of data left behind can give law enforcement a huge advancement (I’ll explain how and show examples in later parts of this guide). Some VPN providers are nothing more than data harvesting schemes. It is highly recommended to NOT use random VPNs that you find online that do not belong to a reputable company or organization. Anyone can set up a VPN and share its connection details online, and then track the online activities of everyone who uses it.

Make sure your VPN uses OpenVPN or WireGuard for encryption. Other encryption types for VPNs are less secure For example, Point-To-Point Tunneling Protocol (PPTP) can be cracked in hours.

Now, when using tor, it is highly advised to use the tor browser. Using the network through other browsers can lead to many security, privacy, and anonymity risks.

Setting up PGP

During the last couple of years, researchers have discovered more vulnerabilities associated with PGP. The modern risks are not about cracking the keys/messages, but rather exploiting how the software handles the keys and external data. Researchers published over a dozen PGP-related vulnerabilities on pgp.fail. Most, if not all of these vulnerabilities affect GnuPG (GPG), the most widely used PGP implementation. Some of these vulnerabilities include Denial of Service (DoS), where attackers can crash GnuPG processes by sending a malicious signature or key, and Arbitrary File Overwrite, where malformed signature patterns can potentially lead to remote code execution.

When creating a PGP key, it is highly recommended to use Sequoia PGP as it is written in Rust and offers a higher level of security. If you are going to use GnuPG (GPG), make sure you use the latest versions, particularly 2.5.17 and higher as a lot of the flaws have been patched. When generating a PGP, it is recommended to either generate a key size of 4096 if you are using RSA, or use Edwards-curve Digital Signature Algorithm which is said to offer strong encryption but with much better performance than with RSA.

Sources and References (Clearnet warning):

pgp.fail

https://www.sentinelone.com/vulnerability-database/cve-2026-24883/

https://www.privacyguides.org/news/2026/01/07/multiple-vulnerabilities-found-in-gnupg/

Part 3: Darknets and safely accessing them

A darknet is essentially an encrypted network within the internet that is only accessible through special software or techniques. They are most commonly used for maintaining privacy and anonymity by people for different reasons: Criminal activities, free speech and whistle blowing, unrestricted economy, circumventing regulations, and more. The 3 most common darknets are the tor network (.onion sites), i2p (eepsites), and Freenet. Tor is generally regarded as the gold standard as it has the most active developers, most funding, and highest user base out of all 3. Not to mention it has its own custom browser that has been in active development for well over a decade. Freenet has vulnerabilities and i2p has little to offer (aside from “garlic routing” which uses different tunnels for incoming and outgoing traffic) that tor does not.

Now, when accessing a darknet, you want to ensure that you are doing so from a secure system. Linux, unix, and BSD systems are the only operating systems you want to be using. Windows takes automatic screenshots all the time and stores them in your system and may even relay them back to Microsoft servers. Along with many other features (integrated AI, etc) that introduces many more potential privacy and security risks. MAC OS, just like Windows, is closed-source, proprietary software, so no one, except for Apple, knows the full extent of what data is being collected through the operating system.

Tails OS is the most recommended operating system for darknet activities because all internet traffic is forcibly routed through the tor network and since the OS is ran off of a USB stick, no data is left behind on your computer. The downside is that you cannot run a VPN underneath tor but you can still use bridges. Another recommended alternative is to use operating systems within a virtual machine (Whonix OS is recommended) within an encrypted container. Use VeraCrypt and choose the option to create a “hidden container”. This will create an encrypted container within an encrypted container. For the outer encrypted container that contains the hidden container with your virtual machine, fill it up with decoy files (like random photos or documents. That way, if the outer container is ever placed under a forensic analysis or if you are ever forced to give up the password for the outer container, the hidden container will look like an empty volume or random “noise”. When using encrypted containers, remember to “unmount” them when not in use.

When using tor browser, make sure you set the security level to "safest", type "about:config" into your URL bar, set javascript.enabled to false, and dom.storage.enabled to false. Doing this will minimize the risk of being de-anonymized or attacked through malicious scripts and minimizes the amount of data from tor being stored on your PC.

Part 4: Telegram Horrors

It has come to my attention that many darknet buyers and sellers have been ditching traditional marketplaces in favor of conducting direct deals through Telegram and similar apps in recent years. This is such a terrible thing to do for a multitude of different reasons that I thought it deserves its own section within this guide.

As many of you already know, conducting direct deals anywhere outside of markets increases the risk of selective scamming by sellers. The biggest risks, however, are to your privacy and anonymity. Telegram isn’t what it use to be, its former CEO was arrested in 2024 and ever since then they have been a lot more cooperative with law enforcement entities. Even before then, Telegram wasn’t ideal for darknet business transactions either.

Before Telegram’s CEO was arrested during September of 2024, Telegram ignored most law enforcement requests. After his arrest the platform updated its Terms of Service saying that it will share IP addresses and phone numbers to authorities who have a valid judicial order. Reports from early 2025 showed that there was a %6,000 increase in fulfilled data requests from the US and EU compared to the previous year. Telegram always sees your real IP address unless you have activated a VPN before launching the application.

The platform requires a valid phone number to sign up and as a result, many users use “burner” phone number to create an account. The downsides to this is the fact that law enforcement can often trace the payment method used to purchase the number or trace the hardware ID (IMEI) of the phone used to activate the number. There is also the risk of accidentally allowing Telegram to sync your contacts list on your phone, so all of your real-world contacts will be uploaded to Telegram servers if that happens.

People say “Telegram chats are encrypted”, which is an accurate but misleading statement. All group chats are stored in a cloud, and Telegram holds the decryption keys to all chats, which they are willing to decrypt for law enforcement. Telegram still offers a 1 on 1 “secret chat” mode, where the encryption keys are said to be stored only on the devices of both participants. However, the platform can still see the metadata; they know who you are chatting with, when you are chatting with them, and your real IP address if you are not using a VPN.

Since 2025, law enforcement uses automated bots or “scrapers” such as the DarkGram framework that joins thousands of Telegram channels simultaneously. These bots flag keywords, track price listings, and identify sellers in real-time. AI tools such as these don’t work anywhere near as well on the tor network due to Captchas and the slow speed of the network.

Sources and References (Clearnet warning):

https://www.kelacyber.com/blog/telegrams-policy-shift-how-cybercriminals-are-reacting-to-new-data-sharing-rules/

https://arxiv.org/html/2409.14596v3

Part 5: Smart Meters can potentially determine everything you do

Smart meters are essentially computerized utility meters for electricity, water, and gas. They transmit usage data remotely through different protocols, such as ZigBee, Bluetooth, radio frequency, power line communication (PLC, through power lines, so technically not remote), and even private proprietary protocols not disclosed to the public. Smart meters can be used to analyze your electric usage down to the microscopic level. When you turn on a light bulb or appliance in your home, the utility company can easily determine what kind of light bulb or appliance got turned on by analyzing electrical usage patterns of those devices.

This has caused concern among privacy advocates as utility companies can easily know when you leave your home, enter your home, and where you are at in your home based on electrical activity (and water usage to a lesser extent). The arguably most terrifying aspect of this, is the fact that they can potentially determine what you are doing on your computer. High frequency smart meters can detect the unique “power signatures” of actions taking place on specific hardware. For example, the CPU spikes associated with loading tor browser’s rendering engine or generating a PGP key.

Screen content inference: While difficult, this is still possible. Research has demonstrated that the power draw of modern monitors varies based on the brightness and color of the displayed pixels. If an adversary were to analyze the milliwatt power fluctuations of your meter, they can potentially determine what websites you are visiting. If they already have a dataset created that contains the fluctuations associated with visiting specific darknet markets or other illegal sites on tor browser, they could easily get a match from your smart meter when you visit those sites.

It is highly recommended to disconnect your computers from the smart grid when doing darknet activities. Either use a laptop that has a very long battery life, or connect your computer to an external power storage unit or generator (usually $800 - $2000 on websites like Amazon).

Sources and References:

https://www.researchgate.net/publication/339593548_Security_of_Smart-Meters_against_Side-Channel-Attacks_SCA

Part 6: Never use a phone for darknet purposes

Cellphones or more specifically Smart Phones, are very different from ordinary, personal computers (PCs).

Cell phones are connected to cell phone towers, which can track your location via triangulation. Law enforcement has set up fake cell phone towers, also known as “stingrays”, to automatically trick cell phones into connecting to them so they can intercept mobile network traffic and track the location of users in real-time (this was revealed by Snowden). The cellular baseband of mobile devices operate independently of the OS and can be used for remote tracking of the device as outlined by a NIST special publication.

Mobile operating systems are highly integrated with cloud services. The Tor project even warns that using tor on mobile operating systems is less private because the operating system (usually Android or iOS) has constant background processes that bypass the tor proxy configuration to communicate with Google and Apple servers.

The mobile version of tor browser does not include the security features found in the desktop version

Every mobile screen has a slightly different size, mobile apps run in full screen mode, which makes it easier for the websites you visit on tor browser to not only see your screen resolution, but also determine which phone model you are using.

Mobile operating systems store local data. There is virtually no amnesiac defense (your history/session being completely wiped) on mobile operating systems when using tor browser.

On mobile, if you click a link that your phone thinks should open in another app (like a Youtube link or PDF), Android might launch that external application outside of tor, leaking your real IP address.

The mobile version of tor browser is more susceptible to Canvas Fingerprinting (using your phone’s GPU to create a unique ID) than the desktop version.

The mobile version of tor browser uses GeckoView, which is a stripped down version of the Firefox engine used for Android. Many of the security patches (“TorUplift”) released to harden tor browsers’ defense against tracking are not yet compatible with the mobile version.

Sources and references (Clearnet warning):

https://support.torproject.org/tor-browser/encountering-issues/known-issues/

https://csrc.nist.gov/publications/detail/sp/800-124/rev-1/final

https://sls.eff.org/technologies/cell-site-simulators-imsi-catchers

https://cyberpress.org/tor-browser-14-5-2-launches/

https://www.bleepingcomputer.com/news/security/tor-browser-135-brings-android-enhancements-better-bridge-management/

Part 7 - LLM-Based Stylometry and Image Management

Large Language Models (LLMs) are evolving at a rapid pace, and are capable of much more than what your average ChatGPT user suspects. For instance, it has been demonstrated that when combining quantitative stylistic features with AI reasoning, darknet posts can be linked to clearnet identities in minutes. Law enforcement scrapes millions of posts from clearnet websites (like Reddit, Twitter, LinkedIn) and darknet websites (Dread and marketplaces).

If you have posts on clearnet websites and do not change your writing style while writing on darknet websites, then it is likely that law enforcement will eventually link your clearnet and darknet identities if they haven’t already. It is a wise decision to write your message, and then enter it into a local LLM on your computer so it can rewrite it in a different style and then copy the LLM’s rewritten message and then post it where you want it. That way, the LLM acts as a “proxy” for your written linguistic patterns.

Now, for sharing and managing images on the darknet

A few simple but very helpful rules.

Never upload the original digital photo

After you have taken a digital photo (let’s say you’re a dealer who took a picture of their drugs to upload to a market) you should have the image open on your desktop and then take a screenshot of the photo.

Now, discard the original photo (so you don’t accidentally upload it) and run the screenshot of the photo through a meta data stripping tool called exiftool. When using it through a terminal the correct command to strip the photo of all meta data and overwrite the initial file is “exiftool -all= -overwrite_original image.jpg” (it might be different depending on the version you are using).

Now, do NOT upload it yet. Even after stripping the meta data from the screenshot of the original photograph, you are still at risk of being caught!

Not surprising at all in the age of AI and highly advanced technologies, right? The latest threat is Sensor Pattern Noise (SPN) which involves analyzing the unique microscopic physical imperfections. These unique imperfections associated with your camera can be detected on all pictures you have taken with it. This is why you don’t want to use a camera that you have used before for darknet activities whether you took other pictures and uploaded them onto the clearnet, or sent selfies to your friends via text messages. [b]Before uploading the final image to the darknet, you should use photoshop to apply a ‘Denoising’ filter or add a layer of grain/noise to the image to throw off the sensor pattern. And for many different reasons, if you are taking pictures of drugs, place it in front of black construction paper to obscure the background completely (so no visible aspects of your location are included in the photo).

Sources and References (Clearnet Warning):

https://exiftool.org/install.html

https://cyberscoop.com/ai-deanonymization-risks-online-anonymity-study/

https://ia.acs.org.au/article/2022/camera-sensor-imperfections-help-identify-devices.html

Part 8: Quantum dangers

2026 marks the first year where quantum systems have actually made substantial, real world progress and significant discoveries. Theoretically, quantum systems will be able to crack modern encryption with ease, allowing nearly all encrypted messages and data throughout history to be read. While this is likely years away, other quantum technologies (some of which may not be directly linked to quantum computing) and techniques introduce new threats to darknet users.

Quantum Machine Learning (QML)

In short, this combines quantum computing with machine learning. QML can be used to process multidimensional datasets far more efficiently than with classical machine learning. Recent research suggests that QML can identify unique patterns in packet timing and volume (“traffic signatures”) even when the traffic is heavily padded or delayed.

Further Quantum Exploitation

Quantum sensors enable a far more efficient means of remotely analyzing the fluctuating electromagnetic emissions from devices like CPUs, monitors, and RAM. (a form of side channel attacks) than traditional methods. Quantum technologies utilize subatomic particles like photons and neutrons for different purposes. How easily external factors like electromagnetic emissions can disturb certain subatomic particles make them incredibly useful for obtaining information about biological entities and electronic devices remotely. It has been suggested that materials that are commonly used to block electromagnetic emissions might not be effective against quantum sensors (in other words, your computer could still be at risk even if it is covered in copper fabric intended to block outgoing EMF and RF emissions).

Sources and References (Clearnet Warning)

https://arxiv.org/html/2504.20436v1

https://postquantum.com/quantum-sensing/ethics-privacy-quantum-sensing/

Part 9: Side Channel Attacks

Side channel attacks refer to non-invasive means of exploiting information inadvertently leaked from systems, such as power consumption, electromagnetic emissions, or execution timing. Below is a list of some of the newest ones, common types, and how some of them have evolved in recent years.

Advanced Website Fingerprinting

This is arguably the most significant side channel attack on tor users. ISPs and malicious entry nodes can monitor the timing, volume, and direction of encrypted packets. Deep Learning Models can recognize the unique structure of a website, even though the data is encrypted, the sequence of packets can act like a signature.

As tor implements a knew feature called “Conflux” where a users’ traffic is split across multiple paths for increased speed, more recent side-channel attacks have taken advantage of reconstructing these split streams to maintain fingerprinting accuracy.

There are packet and noise injection programs and techniques that can help defend against this. Such as WTF-PAD. When using tor, it is best to use only website at a time and then clicking “New identity” before using another website.

Acoustic attacks

If the microphone on your computer or a nearby smartphone is compromised, your keystrokes can be recorded, analyzed, and reconstructed with AI (so they know almost exactly what you were typing) with around %90 accuracy.

There are many different kinds of side-channel attacks that can potentially pose threats to darknet users. However, I have mentioned them in other parts of this guide.

Sources and References (Clearnet warning):

https://www.bleepingcomputer.com/news/security/new-acoustic-attack-determines-keystrokes-from-typing-patterns/

https://ieeexplore.ieee.org/document/11023397/

https://mjuarezm.github.io/assets/pdf/ccs18.pdf

https://www.allaboutcircuits.com/technical-articles/em-side-channel-attacks-on-cryptography/

Part 10: CPU and GPU Vulnerabilities

When people think about processors, they usually think in terms of how powerful it is, how it can “push” the other components of the computer such as the graphics card. What most people don’t know is, is the fact that modern CPUs and GPUs are among the most advanced pieces of technology available to the general public today. They are equipped with different features, subsystems and technologies that enable many different kinds of functionalities.

Intel Management Engine

Often described by security researchers as a “computer within your computer”, It is essentially a tiny processor that runs within the intel chip set that runs on the Minix OS, has its own micro-controller and has it owns network stack. It can access all data on the RAM, or communicate the internet while completely bypassing VPNs and tor. If Intel ME is compromised in a particular machine, there is really no way to stop the attack unless you replace the intel hardware entirely as wiping the operating system and replacing it will do nothing. AMD also comes with an equivalent: Platform Security Processor (PSP), which might be riskier as it is far less documented than Intels’ ME.

There are also CPU-based exploits. Transient execution attacks have been performed by targeting the CPU’s main speed-boosting features to cause memory leakage. These attacks primarily became known as Spectre and Meltdown. There are patches available, but there is no way to be completely secure from these attacks as modern 64-bit architecture itself is flawed.

-GPU Rendering Differences

Tor browser, like other modern web browsers, utilize integrated GPUs to offload certain tasks. When tor browser uses it to render a website, it creates a signature of your physical hardware. Websites can use small, malicious scripts to see how fast your GPU reacts to create a unique profile for your computer. Since GPUs handle the pixels for your entire screen, malicious websites can exploit this to obtain more information about the processes that are being carried out by your GPU and may be able to collect other information such as what you are typing, or what is happening in other open windows.

Disable the integrated GPU through your computers’ BIOS settings, or disable “Hardware Acceleration” in tor browser. The latter is recommended to avoid optimization issues. This can be done by going into the settings of Tor browser, click on “performance”, and the uncheck both “use recommended performance settings” and “use hardware acceleration settings when available”. After that, restart tor browser.

-Clock Skew

No hardware clock is perfect, and all hardware clocks are processing time slightly differently. (the differences are usually in milliseconds) By observing “timestamps” in each packet, an adversary could identify all encrypted packets coming from your device.

-Thermal Side Channels

Heat patterns generated by your CPU or GPU can be analyzed to determine what you are doing on your machine. However, as long as you don’t have any compromised sensors, or encounter any malicious scripts (set tor browser to the strictest security settings) that were designed to monitor the heat spikes from your hardware, you likely won’t have to worry about this one. Use an effective external cooling device for your computer if you are worried about this.

-”Pixnapping”

This attack uses GPU side channels to reconstruct on-screen content. This bypasses traditional sandboxing in mobile anonymity-based web browsers. Another reason to not use the darknet on smart phones.

Sources and References (Clearnet warrning):

https://firecompass.com/weekly-report-new-hacking-techniques-and-critical-cves-14-oct-21-oct/

https://www.securityweek.com/new-attack-shows-risks-of-browsers-giving-websites-access-to-gpu/

https://arxiv.org/html/2509.19959v1

https://www.hertzbleed.com/

Final words and Further Advice

The threats to darknet users and online privacy is constantly evolving and it is up to you to remain informed in this evolving landscape and determine the steps you need to take to protect yourself.

Here are a few last tips of advice:

-Create a “Faraday Cage” to block electromagnetic emissions

There are a lot of ways to do this. I would recommend going onto a website like Amazon, buy thin lead sheets, mylar blankets, copper tape, cardboard boxes, and a silver-infused canopy. Create a small “room” in your house out of the cardboard boxes (make sure the boxes are flattened first). But first, place the lead sheets and mylar blankets between the flattened boxes, and use the copper tape to tape it all up. Make sure ALL of the cardboard is covered in copper tape, so much that none of the cardboard is visible. It is recommended to place the silver-infused canopy inside of the “room” (you’ll need something to hold it up, do not apply tape to it). Make sure there is shielding placed on the floor in this area, and you’ll need a small hole in the cardboard so you can place your external WIFI adapter outside of the shielded area (otherwise you won’t get an internet connection). You will also need to cover the WIFI adapters’ cable (along with the area with the hole) with EMF shielding materials as well because EMF leakage can occur through the cable. Having several layers of electromagnetic shielding and using different materials is essential as it blocks a multitude of different wavelengths. Also make sure to wear gloves before handling lead-based materials.

Earlier I mentioned disconnecting from the power grid because smart meters can be used to determine your computer activities. Have your power storage unit inside of the shielded area as well. The electromagnetic emissions from the unit could potentially be used to remotely collect information about your computer or its power consumption.

-When conducting darknet activities, make sure your smart phones, smart watches, and similar devices either have the battery removed from them, or are placed in their own “faraday cages”.

These devices contain so many different kinds of sensors, and are also usually equipped with microphones which can be used to collect information from other devices such as your computer. AI can analyze the sound of your keystrokes and know exactly what you are typing.

-On your computer, go into the BIOS, disable bluetooth, and the microphone and camera if present on your device. Also, lock the BIOS with a password for enhanced security.

Always spoof your MAC address for each session

Generate PGP and other encryption keys offline

Change your writing style or use LLMs to “proxify” your writing

Never use the same username on different platforms unless you absolutely need to

Don’t tell anybody in real life about your darknet activities (unless they are also involved with what you are doing).