BlackOps Adversary Register Who takes money off buyers, and what actually stops them No ads, no affiliates
Register › Who is after you

BlackOps addresses

Three published addresses for the same market. Copy rather than retype, and verify the signature once you are through.

Mirror 1 blackops5l63qnwnmlnsfvtlu66md3x3vp3fdtpna42eq7ozujr67hid.onion
Mirror 2 blackops6kignp3eddmvqcfkjzf6qr6haxbmkypc2xtqlnhuu4ak4dqd.onion
Mirror 3 blackops27m32abqvbhnyswgazqawxqbznbzkkkv5sjo7gve2ndpsdad.onion

This site publishes the list and does not monitor it. An address that opens is not an address that is genuine, and the check that settles it takes under a minute.

The recycled address operator

The one adversary in the register that specifically catches people who have been doing this for years.

What they want
The same as the clone operator. What differs is how they reach you, and the difference is worth its own page.
How they earn
Traffic that was already heading somewhere, arriving from old bookmarks, archived pages, unmaintained directories and forum posts nobody has touched in years.
What it costs them
Generating an address that matches the recognisable opening characters. Four or five characters takes minutes on an ordinary machine. Seven or eight takes days and is still entirely practical. Matching the whole thing is impossible, which is the only good news here.
How you meet them
You go where you always went. That is the whole method. They do not have to reach you at all.
What gives them away
The middle of the address, which is where a near miss differs and where reading stops. And the fact that an address which was dead for a stretch is now answering, which never happens in the legitimate direction.
What stops them
Deleting retired addresses instead of archiving them, and comparing the middle rather than the ends.

Why this one reaches the wrong people

Every other adversary in the register is filtered by experience. A newcomer is more likely to fall for fake support, an exiting vendor, or a forum link. Experience helps against all of them.

This one inverts that. The reader most likely to hold a long dead address is the one who has used the platform longest, has the strongest sense of knowing what they are doing, and is most likely to skip checking a string they recognise. Familiarity does all the work, and familiarity has never been evidence.

The rule with no exceptionsAn address that stopped working and later starts working again has not recovered. Nothing retired returns under the same string, so something resembling it is answering under different ownership. Close the tab.

Being precise about what is possible

Possible?
Taking over the exact addressNo, absent a key compromise. An address is derived from a private key and serving traffic there requires holding it.
Standing up a close resemblanceYes, and cheaply. This is what you will actually encounter.

So the forgery always has the same shape: a familiar opening, sometimes a familiar ending if they bothered, and a middle that differs. Base32 as used here has no visually confusable character pairs by design, which means an address that looks slightly off genuinely is off. That is never a font problem.

The habit that removes this entirely

  1. Keep addresses somewhere you control and note the date beside each one. A browser bookmark hides the string behind a name you chose, which removes the moment you would have noticed it changed.
  2. Compare what you hold against a published list every few weeks. Under a minute, and it is the whole maintenance burden.
  3. Delete rather than archive when something drops off. An address kept just in case is one you might paste on a distracted evening months later.
  4. Verify on arrival regardless of how familiar the string looks, because recognition is exactly the feeling being exploited.