BlackOps Adversary Register Who takes money off buyers, and what actually stops them No ads, no affiliates
Register › Who is after you

BlackOps addresses

Three published addresses for the same market. Copy rather than retype, and verify the signature once you are through.

Mirror 1 blackops5l63qnwnmlnsfvtlu66md3x3vp3fdtpna42eq7ozujr67hid.onion
Mirror 2 blackops6kignp3eddmvqcfkjzf6qr6haxbmkypc2xtqlnhuu4ak4dqd.onion
Mirror 3 blackops27m32abqvbhnyswgazqawxqbznbzkkkv5sjo7gve2ndpsdad.onion

This site publishes the list and does not monitor it. An address that opens is not an address that is genuine, and the check that settles it takes under a minute.

The credential stuffer

The most impersonal adversary in the register, and one of the most successful.

What they want
Any account that opens with a credential pair they already have. They are not looking for you specifically and never were.
How they earn
Volume. A tiny success rate across an enormous list is still a business, and the accounts that open get used or resold.
What it costs them
Effectively nothing. The credentials came from breaches of ordinary services with no connection to this activity.
How you meet them
You do not. Your password was leaked years ago somewhere unrelated and is now in a list that gets tried against everything.
What gives them away
Nothing, until an account opens. There is no interaction to recognise, which is why this one is handled by prevention only.
What stops them
A password used nowhere else, and a second factor. Both are cheap and both are complete answers to this specific adversary.

Why reuse persists

Because the cost is invisible at the moment you pay it. Reusing a password produces no bad outcome that day, that month, or often that year. The consequence arrives long after the decision, attached to a service you have forgotten about, which is a shape people are famously bad at reasoning about.

It is also worse here than in ordinary life. Elsewhere a compromised account is an inconvenience with a recovery process behind it. Here there is no recovery process worth the name, no institution to appeal to, and the account may be holding funds.

The common misunderstandingPassword strength is not the issue and never was. A long complicated password reused somewhere that leaked it is exactly as useless as a short one. Uniqueness is the property that matters.

What two factor adds, and what it does not

AttackDoes two factor stop it?
A leaked password tried laterYes, completely. This is exactly the attack it was designed against.
A live clone pageNo. It collects the password and the code together and replays both while the code is still valid. See the clone operator.
A compromised machineNo. Nothing on the account side helps.

The part people regret

Recovery material, saved at setup, before closing the page, somewhere separate from the password. Recovery without it is limited and often impossible, and the position nobody wants is holding a balance behind a challenge they can no longer answer. Keep it off a single device, out of screenshots, and test once that you can actually produce it.