n0n: Leak Site, Infrastructure and Victims of a New Extortion Operation

n0n appeared on the dark web in September 2026. Within five weeks, its leak site had listed more than a hundred organisations, and a campaign targeting ports, shipping companies and logistics providers brought the group into wider public attention.

The scale of the listings is striking, but the numbers alone do not explain how the operation works or how successful it has been. Its own records tell a more complicated story. Victims appear under anonymous placeholders before being named, ransom demands can change substantially within days, and sample files attached to seemingly unrelated organisations contain overlaps that raise questions about where the data originated.

By following n0n's leak site, its RSS feed, connected infrastructure and payment records through StealthMole, this investigation examines how the group built its public presence, what its maritime campaign reveals about its possible access to victim data, and whether its claims of scale are reflected in the evidence available.

A New Name on the Dark Web

n0n's leak site provided the first look at how the group presented itself. Its approach was straightforward: list an organisation, set a deadline and threaten to publish its data if the victim failed to pay.

• nongze***************************************snad.onion

The next question was when the operation first surfaced and how quickly it began naming victims. Searching for n0n in StealthMole's Telegram Tracker brought up an early post from the threat intelligence channel DARKFEED, which identified the group as a new threat actor on 18 September 2026. About an hour later, Ransomfeed News reported Venezuelan internet provider Inter as the group's first publicly named victim, with the post timestamped 17:51 GMT.

The two reports place n0n's public emergence and its first reported victim within a short period. They provide an early reference point for tracking the operation, although they do not establish when the group began operating privately or whether Inter was its first actual target.

The leak site also reveals how n0n wants victims to experience the extortion process. It runs without JavaScript under the tagline “no js | no mercy” and separates listings into four tabs: Pending, Exposed, Leaked and Honor. Each listing carries a countdown, and the site states that data will be published when the timer expires without payment. Victims are instructed to use a personal key from their ransom note to enter a private negotiation room.

This arrangement connects the public pressure campaign to a private negotiation process. The listing makes the threat visible, while the countdown gives it a deadline. The private key provides a separate route for the victim to engage with the group. These are the procedures n0n describes on its site; the available evidence does not establish whether every victim was handled in exactly this way.

There is also a detail that matters when tracking the group across different sources. A notice in the site's footer specifies the preferred spelling, “n0n”, with a zero between two lowercase n's, and lists alternative spellings that visitors should avoid. The notice first appeared in the group's RSS feed on 12 October.

That clarification provides a useful reference when searching for the group across Telegram, leak records and other indexed sources. It also highlights a practical issue in actor tracking: a search that relies on one spelling may not capture every relevant reference, while similar names can introduce unrelated activity.

A snapshot dated 27 October showed three figures in the site's footer:

• 105 organisations listed
• 2,300,186 site visits
• 307,163 data downloads

The three figures should not be treated as equally reliable. The visit and download counters are controlled by the group and cannot be independently verified from the available evidence. The organisation count, however, matches the listings visible on the site. It provides a more defensible measure of the group's published victim list, although it does not independently confirm 105 successful intrusions.

From Onion to Clearnet

The leak site was not the only location used to make n0n's claimed stolen data available. Its victim listings promised downloadable archives in ZIP and torrent formats for organisations that failed to pay. Following the links from the onion site in StealthMole's Dark Web Tracker led to a separate clearnet domain: n0n.**.

Nine torrent files linked directly from the leak site had been collected on 21 September 2026:

• https://n0n.**/t/uft.torrent
• https://n0n.**/t/vn-betting.torrent
• https://n0n.**/t/astrazeneca-tr.torrent
• https://n0n.**/t/minedu-ar.torrent
• https://n0n.**/t/stokr.torrent
• https://n0n.**/t/paypal-transcom.torrent
• https://n0n.**/t/argentem-creek.torrent
• https://n0n.**/t/konnatus.torrent
• https://n0n.**/t/beliteacher.torrent

The filenames correspond to nine organisations already named on n0n's leak site: the United Federation of Teachers, a Vietnamese betting operator, AstraZeneca Türkiye, Argentina's Ministry of Education, STOKR, Transcom's PayPal support operation, Argentem Creek Partners, Konnatus and BeLi Teacher.

The important detail is that these were not simply files found on a separate website with a similar name. The torrent URLs were linked directly from the group's own victim listings. This establishes a clear connection between the onion site and the clearnet domain, and shows that the latter was being used to distribute archives associated with the listed victims.

To establish whether n0n.** appeared elsewhere in the available intelligence, the domain was further investigated in StealthMole's Dark Web Tracker. The search returned 13 Tor URLs referencing it. All belonged to n0n's leak site, including the homepage and listing pages for the early victims. No other dark web page, Telegram channel or leak record referenced the domain in the results examined.

The Group's Own Record

The leak site's footer links to an RSS feed that provides a more useful record of n0n's activity than a single snapshot of the site. StealthMole’s captured snapshots of the leak site showed active entries, their status and their deadlines. Because the captures preserve earlier versions of the feed, they make it possible to compare how n0n's public claims changed over time, including cases where a current listing no longer reflects what appeared in an earlier snapshot.

• nongze******************************************snad.onion

The first capture, dated 21 September, already marked nine victims as “not paid, data published”. Their deadlines ranged from 19 September to 21 September. This places the first claimed publications within days of the group's initial appearance in the available reporting.

The feed becomes particularly useful in early October, when n0n began adding entries under anonymous labels such as “Company #74”, accompanied by a brief description of the organisation's sector and location. As deadlines approached, some of these entries reappeared under the organisation's actual name.

Several examples illustrate the pattern:

Placeholder	Description in Feed	Later Named As
Company #22	Neurology practice, New South Wales	Hunter Neurology
Company #24	Smart building and surveillance integrator, California	Interior Technologies
Company #70	FX liquidity and trading technology, Netherlands	Solid Trading B.V.
Company #74	Semiconductor manufacturing, California	SMIC US Company
Company #76	Fintech payments, US	Finzly Corp

This pattern has two implications for interpreting the group's activity.

First, a placeholder and its later named version may represent one organisation at two points in the publication process, rather than two separate victims. Counting every record independently would therefore inflate the apparent size of the operation.

Second, the feed gives a view of how n0n stages its public disclosures. The anonymous entries preserve some information about a target while withholding its name; later updates make the identification public. The timing is consistent with a staged disclosure process, although the records do not establish why the group chose to anonymise particular victims or whether every placeholder was eventually named.

This distinction became clear when n0n was searched further in StealthMole's Ransomware Monitoring. The search returned 133 recorded victims associated with n0n, including duplicate records for organisations listed first as placeholders and later by name.

Who n0n Targets

The early victim list shows no clear concentration in a single sector. Between 18 September and early October, n0n named organisations ranging from internet and IT service providers to healthcare, finance, government and retail.

Among the early listings were:

• Inter, Venezuela's largest internet provider.
• Transcom WorldWide, through its PayPal customer support operation.
• AstraZeneca Türkiye.
• Argentina's Ministry of Education.
• The United Federation of Teachers in New York.
• Fanatics, the US sports merchandise company.
• Dediserve, a cloud hosting provider in the iomart group.
• FinSoft, an Uzbek retail software vendor.

Later listings included US healthcare practices, managed IT providers, a fintech payments vendor, a semiconductor firm's US arm, a dental laboratory, a hotel and a Korean IT services company.

The range of organisations suggests that n0n was not limiting its public campaign to one industry. However, the victim list alone cannot establish whether the group selected targets opportunistically, obtained access through a common third party, or acquired data from multiple unrelated sources.

The wording of some early listings is also worth examining. Several go beyond threatening to release stolen files and claim extensive disruption to the victim's systems.

AstraZeneca Türkiye's listing states that “all sites are enforcing a total network blackout until settlement”. FinSoft and AFRICA-TECH are told that “all backups and shadow copies are encrypted or destroyed”. The Dediserve listing claims that all 46 servers at its Frankfurt site and their backups were removed.

These statements portray n0n as an operation capable of affecting entire victim environments, not merely obtaining and publishing documents. But the distinction between a group's claim and a verified incident is important here. The available evidence does not independently confirm the extent of the alleged disruption, encryption or destruction.

The Maritime Campaign

On 12 October 2026, n0n published 38 organisations from the port, shipping and logistics sector in a single batch. The listings covered 18 countries, with South Korea accounting for 12 organisations.

The timing is notable. Thirty-eight organisations across 18 countries appeared in a single short window, rather than being added gradually over several days. This establishes a coordinated publication event, although it does not by itself show that all the data was acquired at the same time or through the same means.

The listings also use a different format from n0n's earlier posts. Each specifies a fixed settlement amount in US dollars, provides a dedicated Bitcoin address and states that payment is verified automatically on the blockchain. Victims are offered a one-time alternative: pay 10% of the stated settlement to the same address and use the transaction ID to claim a private negotiation room.

Unlike the earlier listings, none of the maritime entries claims network disruption. The stated leverage is the data itself.

This difference matters because it changes what can be inferred from the group's own descriptions. The earlier posts presented n0n as having extensive control over some victims' systems. The maritime entries instead emphasised possession of data and the prospect of publication. The records do not establish whether this reflected a different acquisition method, a different type of access, or simply a different way of presenting the campaign.

The Ransom Demands Did Not Stay the Same

The initial ransom demands attracted considerable attention. Public reporting placed the total for the maritime batch at around USD 1.22 billion. Yet the 21 October leak-site snapshot gives a much lower combined figure of approximately USD 275.8 million.

The difference becomes clear when the RSS feed captures are compared. Between 12 and 16 October, n0n reduced the five largest demands while leaving the other 33 unchanged.

Listing	12 October demand (USD)	16 October demand (USD)
Ocean Network Express	400,000,000	25,000,000
Apical Group	320,000,000	25,000,000
ZPMC	160,000,000	18,000,000
Dongkuk Steel	100,000,000	10,000,000
T.S. Lines	56,000,000	10,000,000

Using the original figures, the 38 demands totaled USD 1,223.8 million. After the five reductions, the total fell to approximately USD 275.8 million.

The important point is not simply that the demands fell. The reductions were concentrated in five listings, while the other 33 remained unchanged. The resulting total was therefore driven heavily by a small number of exceptionally large demands.

The records establish that n0n changed its pricing within four days of publishing the batch. They do not explain why. The reductions could reflect a change in the group's negotiating position, an attempt to make the demands more realistic, or another motive, but none of these explanations can be established from the feed alone.

What can be said is that the original billion-dollar total was not a stable measure of the group's eventual demands. Any assessment of the campaign needs to account for when the figures were recorded rather than treating the first published amounts as the final position.

One Source, Many Victims?

The sample files attached to the 38 maritime listings raise a more substantial question: do they represent data taken independently from each named organisation, or could at least part of the batch have come from a common source?

Several filenames refer to the same family of maritime software, OPUS and ALLEGRO, across different organisations:

• Eurogate Tanger: 524900_[PNO+MGT+WebPortal] EGT_Release Note_Release_OPUS Terminal_20230707.docx
• NCT Kandla: 93101_RE KAP OPUS MGT is down URGENT00069.msg
• Korea Ferry: 436473_OPUS ADMIN_KFC STAFF.xlsx
• Portonave: 164167_sl-opus00060.txt
• CULines: 848346_UGL BL template on Allegro - 0807.xlsx
• Tsuneishi / Kambara Kisen: 658686_Allegro Seacast CSV June.2024-1.xlsx

The filenames are not the only point of overlap. Several samples read like correspondence between a software vendor and its customers, including release notes, a gap analysis report, enhancement requests and an urgent support email about a system outage. That is different from a collection made up exclusively of documents that clearly originate from each victim's internal systems.

The filenames also share a structured format. Each begins with a numeric ID, and many end with a five-digit counter. The same general pattern appears across listings associated with different organisations. One file appears under both April Asia and GlobalNet LCL.

These details raise the possibility that at least part of the batch came from a common archive or system rather than from 38 wholly separate collections of data. The repeated software references suggest a connection to the maritime technology ecosystem, while the filename structure and duplicate sample provide additional reasons to examine whether the files share a common origin.

That remains a hypothesis, not a confirmed explanation. Shared software does not, on its own, prove a shared breach, and the available filenames cannot establish how the files were obtained or whether all the organisations were affected in the same way.

There is, however, an external assessment that aligns with this interpretation. Maritime cybersecurity firm Cydome has publicly assessed that the batch likely originated from a single support archive linked to CyberLogitec, a South Korean maritime software vendor owned by EUSU Holdings. CyberLogitec develops the OPUS and ALLEGRO products referenced in the samples.

The relationship is worth noting because EUSU Logistics, which shares the EUSU name, is itself among the 38 listed organisations. Its attached samples include an infrastructure assessment and file server configuration.

The available evidence does not prove that CyberLogitec was the source, and CyberLogitec has not confirmed an incident. Nor does the shared EUSU name establish a connection between the data in the listings and the vendor or its owner. Nevertheless, the repeated OPUS and ALLEGRO references, common filename patterns, duplicate sample and vendor-style correspondence are consistent with Cydome's assessment that a common support archive may be involved.

By 21 October, the deadlines for all 38 maritime listings had expired. All were marked “NOT PAID — LEAKED”, with ZIP and torrent downloads attached. The group had therefore moved from threatening publication to claiming that the data was available, but the listing status alone does not independently verify the completeness or provenance of each archive.

Following the Payments

The ransom demands provide one measure of the scale n0n wanted to project. The Bitcoin addresses attached to each listing offer another way to examine the campaign: rather than relying on the group's stated settlement status, payments can be checked against the addresses it published. Each of the 38 maritime listings carried a dedicated Bitcoin address.

Victim	Country	Settlement (USD)	Bitcoin address
Tsuneishi / Kambara Kisen	Japan	28,000,000	bc1qx***************t49
Santos Brasil	Brazil	26,000,000	bc1q****************h2z
Ocean Network Express	Singapore	25,000,000	bc1q****************4x8
Apical Group	Singapore	25,000,000	bc1q***************hne
ZPMC	China	18,000,000	bc1q****************avt
EUSU Logistics	South Korea	14,000,000	bc1q3***************g98
Pusan Newport Company	South Korea	12,000,000	bc1q***************8asn
Polaris Shipping	South Korea	12,000,000	bc1q****************hue
Samudera	Indonesia	12,000,000	bc1q****************k9c
Dongkuk Steel	South Korea	10,000,000	bc1q****************5ml
T.S. Lines	Taiwan	10,000,000	bc1q****************03m
TTI Algeciras	Spain	10,000,000	bc1q****************fvr
Yusen Logistics Hong Kong	Hong Kong	8,000,000	bc1qp***************egm
BNCT (Busan New Container Terminal)	South Korea	8,000,000	bc1q****************l83
CULines	China	7,800,000	bc1q****************7f2
Eurogate Tanger	Morocco	6,000,000	bc1q****************lcy
Portonave	Brazil	5,800,000	bc1q****************myf
Nam Dinh Vu Port	Vietnam	5,000,000	bc1q****************827
Asyaport	Türkiye	4,800,000	bc1q****************a4e
NEOM Ports	Saudi Arabia	4,000,000	bc1q****************4ph
Dong-A Tanker	South Korea	3,200,000	bc1qh***************dv8
ILCS Pelindo	Indonesia	2,400,000	bc1q****************tkg
T2S	Brazil	2,400,000	bc1q****************e46
Camellia Line	Japan	2,000,000	bc1q****************4ug
HPC Hamburg Port Consulting	Germany	2,000,000	bc1q****************6ga
NCT Kandla	India	1,600,000	bc1q***************r9p
Superterminais	Brazil	1,600,000	bc1q***************pt8
BKH ICD	South Korea	1,200,000	bc1q****************5ra
GNCNet / DGT Busan	South Korea	1,200,000	bc1q****************g6p
Korea Ferry	South Korea	1,200,000	bc1q****************7vc
GCS Kuwait	Kuwait	1,000,000	bc1q****************c9s
April Asia	Indonesia	800,000	bc1q****************td6
GlobalNet LCL	Indonesia	800,000	bc1q****************mh3
MGNP	South Korea	800,000	bc1q****************m96
Premier Alliance	Netherlands	800,000	bc1q*****************xy
Samjoo Maritime	South Korea	600,000	bc1q****************05s
BMT IQ	United Kingdom	400,000	bc1q****************j0l
Saehan Marine	South Korea	400,000	bc1q****************usw

The address list gave a way to test whether the campaign had generated any visible payments. A review of public blockchain records as of 22 October 2026 found no transactions received by any of the 38 addresses. This includes the smaller 10% payments that n0n said would unlock a private negotiation room.

That result is significant when considered alongside the changing ransom demands. The group initially attached more than USD 1.2 billion in demands to the batch, later reduced the total to approximately USD 275.8 million, and marked the listings as leaked after their deadlines expired. Yet none of the published addresses had received an on-chain payment by the date checked.

This does not establish that no victim negotiated with n0n or that no payment could have been made through another route. It does establish that the 38 addresses published for this campaign showed no incoming transactions in the records reviewed. The settlement amounts should therefore be treated as demands, not money received.

The picture outside the maritime batch is different. The leak site's Honor tab lists ten anonymised organisations as having “honored their deadline”, with their data marked as destroyed between 5 and 20 October. All ten entries are anonymised. The first two, described as a US technology company and a Canadian financial services firm, were recorded as settled on 5 and 7 October.

These entries suggest that n0n claims to have reached settlements with other victims, but the site's statements are not independently verified payment records. Unlike the maritime listings, the Honor entries do not provide named Bitcoin addresses that can be matched to those outcomes.

One case in the historical RSS captures offers a possible link between a named victim and an anonymous entry. In the 12 October capture, Company #23, described as an architecture and design firm in Florida, was pending with a deadline of 14 October. By 16 October, the feed listed Trieschmann Dumala Architectural Group as “not paid, exposure passed”, with exactly the same deadline. In the 21 October snapshot, Trieschmann Dumala no longer appeared, while Company #23 was listed in the Honor tab with its data marked as destroyed on 18 October.

The matching deadline and description support the possibility that Company #23 and Trieschmann Dumala were the same organisation, later moved back into an anonymous entry after a settlement. The connection has not been confirmed, however, and the available records do not independently establish that a payment occurred.

The contrast is worth keeping in view: the maritime campaign's published wallets showed no incoming transactions, while n0n's own records claimed that ten other organisations had settled. One finding is based on the reviewed blockchain records; the other remains the group's account of its negotiations.

What the Group Says Comes Next

The 21 October snapshot of n0n's leak site included a banner under the heading “COMING SOON”. It announced a future publication involving:

• “more than 500 organizations”
• a “combined value almost 1 trillion USD”
• “the largest breach we have held to date”

No organisation names, sample files or download links accompanied the announcement.

The same banner stated that n0n would be “opening our affiliate doors”, inviting other hackers to apply and “become n0n as well”.

The proposed publication would represent a substantial increase on the 102 organisations listed in the 21 October snapshot. But at this stage, the announcement is a claim about future activity, not evidence that the group has obtained data from more than 500 organisations or that the combined value of the material approaches USD 1 trillion.

The maritime campaign offers a reason to be cautious about taking the headline figures at face value. Its original demands totalled more than USD 1.22 billion before being reduced to approximately USD 275.8 million within four days. That history does not prove the next announcement will be exaggerated, but it shows that figures published by the group can change substantially.

The affiliate announcement is also significant, although its implications remain uncertain. If implemented, it could extend the n0n name beyond the original operators by allowing other hackers to participate under the same brand. It is not yet clear whether this would involve a formal affiliate programme, shared infrastructure, revenue sharing or simply permission to use the name. None of those arrangements can be confirmed from the banner alone.

Conclusion

The evidence collected so far shows an operation that developed a visible leak-site presence quickly, used its own RSS feed to track changing victim listings, and connected its onion site to a clearnet domain hosting torrent files. The historical captures also reveal that the published victim count needs to be deduplicated: anonymous placeholders and later named entries can refer to the same organisation, while searches for the group's name can return records belonging to unrelated actors.

The maritime campaign is the most significant finding in this investigation, but not simply because it involved 38 organisations across 18 countries. The shared OPUS and ALLEGRO references, recurring filename structure, duplicate sample and vendor-style correspondence raise the possibility that at least part of the batch originated from a common data source. Cydome's assessment of a possible CyberLogitec-linked support archive is consistent with those observations, but the source has not been confirmed.

The payment records add another dimension. As of 22 October, none of the 38 Bitcoin addresses associated with the maritime campaign had received a transaction, despite the group's substantial published demands. Its Honor tab, meanwhile, claimed that ten other organisations had settled. Those claims remain unverified, and one apparent link between a named victim and an anonymised Honor entry is suggestive rather than conclusive.

The findings show why n0n's published numbers should not be used as a direct measure of successful attacks or financial returns. The group has demonstrated a consistent public process for listing organisations, setting deadlines and publishing data it claims to hold. However, the number of listings, the origin of the data, the extent of compromise and the money actually received are separate questions. The available evidence answers some of them more clearly than others.

The announced plan to publish data relating to more than 500 organisations and open the operation to affiliates could mark a new phase, but it remains untested. Whether n0n can turn that stated ambition into a larger and more effective operation will depend on what appears next, not on the size of the figures in its own announcement.

Editorial Note

Dark web investigations rarely provide a complete picture. Threat actors control their own publications, change claims and listings over time, and have an incentive to present their operations as larger or more successful than the available evidence may support. In this case, StealthMole's historical captures, Dark Web Tracker, Telegram Tracker and Ransomware Monitoring helped connect the group's infrastructure, reconstruct changes to its victim records and compare its public claims with observable evidence. Those findings make the operation easier to assess, but questions around the source of the maritime data, the extent of individual compromises and the group's actual financial returns remain open.

To access the unmasked report or full details, please reach out to us separately.

Contact us: support@stealthmole.com

NamasteLSD: The Vendor That Disappeared, the Brand That Remained

For nearly three years, NamasteLSD built a recognisable presence in the dark web drug trade, selling LSD, MDMA, ketamine, 2C-B and other substances through darknet markets, a private onion store and a Telegram bot. Operating from Europe and shipping internationally, the vendor had established a product catalogue, accumulated customer reviews and built a following that extended from Western Europe to India by 2021.

The investigation focused on two questions: what could be established about NamasteLSD's operations, and whether the vendor was still active. Tracing its activity across Tor, Dread, Telegram and Reddit helped reconstruct the vendor's history and the accounts it used to operate. However, the investigation also uncovered a separate issue. In October 2026, NamasteLSD-branded infrastructure was still appearing in scans and advertisements, raising questions about who was behind the activity.

The distinction between the original vendor and the later use of its name is important. Continued activity under an established brand does not necessarily mean the original operator has returned. Without separating the two, researchers risk attributing activity to the wrong actor, while buyers may mistake an unauthorized operation for the original vendor.

A Name, a Store and a Page Full of Answers

The investigation began with a search for "NamasteLSD" in StealthMole's Darkweb Tracker. The search returned more than a thousand Tor domains, but most were link directories and search engines that had indexed the vendor's name. Buried among those results was the vendor's private store.

• Private store: namastehtkkctyoa.onion

StealthMole listed the store multiple times between 2020 and 2021, capturing its product pages, news feed, support page and FAQ. The FAQ dated 5 March 2021 provided the starting point for tracing the vendor's online presence. What was meant to answer routine customer questions turned out to be one of the most useful sources in the investigation. It documented the accounts, contact channels and platforms NamasteLSD used to communicate with customers.

The contact details provided several leads to follow:

• Dread username: /u/NamasteLSD
• Subdread: /d/NamasteLSD
• Reddit username: /u/NamasteLSD, marked as banned, with DSLetsaman listed as a replacement account
• Subreddit: /r/NamasteLSD, also marked as banned
• Email: NamasteLS**********@protonmail.com
• TheMajesticGarden profile: u=7******0, under the username NamasteLSD
• Wickr: Offered for bulk orders or potential collaboration

The FAQ also pointed to a DarkEye review profile and directed customers to the Raptor link directory. These details provided a way to move beyond the store itself and examine the accounts and services associated with the name.

Built to Be Trusted, Built to Keep Moving

NamasteLSD's own records reveal how the vendor managed its identity, handled shipments and kept its sales channels running when the main store was unavailable. PGP signatures connected its public identity across platforms, while the store's FAQ documented a shipping network and several alternative ways for customers to place orders.

Identity that could be verified

PGP was central to how NamasteLSD established its identity. A May 2019 news post announcing Monero payments was signed with an earlier key. In October 2019, the vendor introduced a new RSA-4096 key and published it with a signature from the old one, allowing customers to verify the transition.

The two fingerprints recorded in the investigation are:

• Earlier key: 5DBD*******************************AD0
• New key, introduced in October 2019: E8468**************************D2FF

The user ID embedded in the new key identifies the NamasteLSD private store and an email address. The key was configured to expire on 13 October 2020, one year after its stated creation date.

• Private Store: http://namastehtkkctyoa.onion
• Email Address: NamasteL**********M@protonmail.com

The same fingerprint appeared on OnionTree and DarknetLive, both indexed by StealthMole. A signed statement in the store's FAQ, dated November 2019, also authorized a New Zealand reseller to sell NamasteLSD's LSD domestically.

• Authorized reseller: HaletianTaboo
• Market: New Zealand
• Signing key ID: 2906**********FF
• Monero address: 841RN****************************************or2cc

These records show how NamasteLSD used signed messages to maintain continuity between its store, payment announcements and reseller arrangements. The reseller statement is particularly relevant because it documents an explicit commercial relationship rather than just another account using the same name.

Logistics designed around getting caught

The store's FAQ also described how orders were shipped. NamasteLSD identified the Benelux region as its shipping base and explained why tracked parcels were handled differently. According to the vendor, tracked shipments required visits to postal counters, where cameras could expose the person sending the package.

The vendor described using multiple people to move parcels rather than repeatedly relying on the same location. For bulk orders, it also offered drivers and dead drops. A November 2020 vendor review published by Darknet Inside described an additional option for larger customers: couriers could carry goods across European borders and post them from within the destination country.

The store also offered two product tiers with different levels of customer support. Standard listings included support and reship options, while cheaper "No-Nonsense" listings came with limited assistance and no guaranteed refund. This gave buyers a choice between lower prices and a more supported purchase.

More than one door in

NamasteLSD maintained several sales and contact channels alongside its private store. A copy of the DarknetPhoneBook v2.0 PDF, captured by StealthMole in March 2021, listed the following:

• Jabber: namas****p@creep.**
• Telegram: @namaste********bot
• Telegram URL: https://t.me/namaste******t
• Darknet markets: Dark, Dark0de, Aurora, ASAP and ToRReZ

The store also promoted the Telegram bot on its subdread, describing it as "DDOS proof". This was relevant because the FAQ acknowledged repeated DDoS attacks against the onion store. The Telegram bot provided another channel through which customers could reach the vendor, although the available records do not establish how consistently it remained operational during outages.

Other entries in the FAQ referred to orders placed through Nightmare Market and Cryptonia. Separately, DarknetLive's coverage of the July 2019 Nightmare breach identified /u/NamasteLSD among the vendor accounts compromised in the incident. This places the account within the reported breach, but does not by itself establish what information was exposed or how the incident affected the vendor's operations.

Across these records, NamasteLSD presented a fairly consistent approach: establish a verifiable identity, distribute sales across several platforms and maintain alternative channels for reaching customers. The documentation also created a detailed record of the brand that could be used to identify the original vendor later. That distinction becomes important when examining activity carried out under the NamasteLSD name after the original operation's active period.`

More Than One Person Behind the Name

Searching /u/NamasteLSD in StealthMole's Darkweb Tracker returned the vendor's Dread profile, archived comments and customer discussions spanning several years. The records showed how the account promoted its products, handled questions and interacted with buyers. They also revealed a second account involved in customer-facing activity, alongside a Reddit profile that provided further insight into how the business operated.

The vendor in its own words

A StealthMole capture from November 2024 shows that the Dread account /u/NamasteLSD had been banned for rule violations. Its earlier activity, preserved in indexed threads, provides a clearer picture of its role in the community.

The account held the "Confirmed Market Vendor" flair and directed users to a PGP guide on its subdread wiki, warning against weak PGP implementations. In a separate classifieds thread on /d/DarkNetAustralia, it used the "International Vendor" flair to advertise a giveaway of at least 1,000 LSD tabs to mark the launch of a new store.

Another discussion, concerning Empire Market's closure, showed the account responding to a user's claim that Wickr had been compromised. The exchange also referenced NamasteLSD's Telegram shop as an alternative contact channel.

The account's Dread activity included the following identifiers and references:

• Main account: /u/NamasteLSD
• Subdread: /d/NamasteLSD
• PGP guide: /d/NamasteLSD/wiki/?id=0f74bbc7
• Account flair: Confirmed Market Vendor
• Additional flair: International Vendor
• Giveaway: At least 1,000 LSD tabs, advertised in a /d/DarkNetAustralia classifieds thread

The same discussions revealed another account, /u/NamasteLSD_S. Both accounts commented in threads about Dread's captcha system, and customers addressed them together when seeking help with orders. One user wrote, "/u/NamasteLSD /u/NamasteLSD_S please help?"

This establishes that both accounts appeared in the vendor's customer-facing activity. The available comments do not identify who controlled the second account or confirm whether it was used by a separate person.

A team, not a lone vendor

A July 2021 interview published by Darknet Inside provides further context. The interviewee described themselves as a NamasteLSD representative responsible for public relations and customer support. They said they had joined the team after ordering from the vendor for a long time, identified Empire as its first market, and stated that products were sourced from laboratories and importers in Europe.

The store's own records support the account of a wider operation. One announcement opened with the words "Both /u/NamasteLSD_S and me", while the FAQ described using other people to transport parcels.

The evidence points to distinct customer-facing and shipping activities, but it does not establish a complete organisational structure. The main account was associated with the brand's PGP identity, and /u/NamasteLSD_S appeared in customer discussions. The interview provides a separate account of someone handling PR and support, although the available records do not conclusively link that interviewee to the second Dread account.

The investigation therefore supports the presence of multiple roles around the NamasteLSD operation, but not the real identities of the people performing them.

The Reddit account the FAQ pointed to

The FAQ listed DSLetsaman as the replacement for the banned Reddit account /u/NamasteLSD. The account's own profile details and comments provide additional evidence connecting it to the vendor.

The suspended account carried the following flairs:

• In r/MDMA: "DN Vendor and Psychedelic enthousiast NamasteLSD"
• In r/2cb: "NamasteLSD - One and Only"

Its comments date to approximately 2019 and include discussions about product quality, returns and product photographs.

In r/2cb, a buyer posted a reagent test indicating a problem with a purchased batch. DSLetsaman acknowledged that a poorly synthesised 100-gram batch of 2C-B had been sold and offered a refund or reshipment. The reply was signed "~ namastelsd".

Other comments provided further details about the vendor's dealings with products:

• Subreddit: r/2cb
• Issue discussed: A poorly synthesised 100-gram batch of 2C-B
• Response: Refund or reshipment offered
• Signature: namastelsd
• Separate discussion in r/MDMA: The account said it had returned a batch of pills because they crumbled.
• Separate discussion in r/2cb: The account asked a user for permission to reuse a product photograph.

The admission concerning the 2C-B batch and the comment about returning pills are consistent with a reseller dealing with upstream suppliers. However, these exchanges do not independently identify those suppliers or establish that the vendor never produced any products itself.

The vendor's clearnet presence

NamasteLSD also maintained a presence outside the dark web. An X account created in May 2020 described itself as a "Deepweb drug vendor" and used the same purple logo found on the vendor's subdread banner.

A domain zone file indexed by StealthMole records the registration of the linked website in the same month.

• X account: @namastelsd
• Website: namaste**.****
• Domain registration: 8 May 2020
• Telegram handle listed on X: @NamasteL*****t
• Telegram shop bot listed in the store FAQ: @namastel******t

The matching branding and timing support an association between the X account and namaste***.***. The two Telegram handles, however, do not match. The available records do not establish whether this reflected a change in the vendor's contact channels, the use of separate bots or activity by another account using the same name.

What the customers saw

Customer discussions on Dread and Reddit provide a view of NamasteLSD's reported shipping origins, customer base and reputation. The records contain both successful delivery reports and complaints about orders, product quality and customer support.

Shipping and Destinations

Customers described shipments originating from the Benelux region and France. Dread discussions included comments such as "from France not NL" and "Ket pack landed! FR-USA". A store listing also advertised blotters shipped from France.

The relevant records include:

• Shipping regions mentioned in the FAQ: Benelux
• Additional origin reported by customers: France
• Dread comment: "from france not NL"
• Dread delivery report: "Ket pack landed! FR-USA"

These accounts indicate that customers associated the operation with more than one European dispatch point. They do not establish the origin of every shipment.

India also featured repeatedly in the customer discussions. Several threads on /d/DarknetMarketsIndia mentioned NamasteLSD and its Telegram shop, including discussions about using Telegram safely on Tails to place orders. One user was still waiting in 2020 for an order placed in March, while a Reddit user in India described waiting three weeks. The FAQ also addressed Indian customers, warning that delivery could be slow while maintaining that shipments were possible.

Customer Feedback

NamasteLSD received favourable reviews alongside persistent complaints. Darknet Inside's 2020 review awarded the store four out of five stars and praised its customer support. A Reddit user also reported that NamasteLSD tabs had tested at approximately 204 micrograms through a drug-checking service. That result remains a user-reported claim and cannot be independently verified from the available records.

Negative feedback covered several areas:

• Shipping delays: Customers reported waiting weeks for orders.
• Customer support: Some users complained that the vendor went silent on Jabber for days.
• Seized orders and alleged scams: A Dread user repeatedly accused the vendor of scamming customers, including in a thread titled "Namaste order seized".
• Product quality: A Reddit buyer reported receiving a product with no apparent potency.
• Broader warnings: An r/darknet post carried the title "NAMASTELSD is a scammer avoid like plague".

These are individual customer accounts, not independently verified findings, and the complaints do not establish that every disputed transaction involved deliberate fraud. They do, however, show that the vendor's reputation was far from uniform. Even as NamasteLSD maintained multiple sales channels and attracted customers in different markets, its public record included recurring disputes over delivery, support and product quality.

A New Store, Then Silence

StealthMole's captures of namastehtkkctyoa.onion, dating back to November 2020, revealed an announcement that introduced a new private store. The banner read "NEW STORE LIVE NOW" and linked to another onion address. Extracting the links from the captured product pages also revealed a separate domain associated with hiring and reseller pages.

• New store: e5fcylcyb76ltvx7tsm3uxiwfftdjhwealtzx7xb54mzftyg6ffjeqad.onion
• Hiring and reseller pages: llvswsrtheafqe76fzowfppwuclxssanjt4noahtgtbklpt2tt3gjuqd.onion

The announcement, written jointly by the people behind /u/NamasteLSD and /u/NamasteLSD_S, described a rebuilt store with automatic Bitcoin and Monero payments, promotional codes, flexible order quantities and improved options for resellers. It attributed previous downtime to DDoS attacks, competitor activity and difficulties contacting Dread's administrator.

The post also claimed that the new system stored no sensitive information, meaning an IP address leak would not expose customer data. A separate subdread announcement referred to new PGP keys for both account holders ahead of the launch.

The new domain used the prefix e5fcy, a detail that becomes significant when examining the later sites built around the NamasteLSD name.

The quiet months

By 2021, customer discussions were increasingly focused on the vendor's absence. A chat log created in August 2021 includes a buyer expressing concern that NamasteLSD had not been seen online for some time. Other Dread users complained that the support account had been absent from Jabber for days.

A post preserved in a DarknetOne screenshot was titled "NamasteLSD has NO COM on Dread for the last week". It specifically noted that neither of the two accounts had been in contact.

The relevant accounts were:

• /u/NamasteLSD
• /u/NamasteLSD_S

On 21 July 2021, Darknet Inside published an interview with a NamasteLSD representative. Asked about law enforcement, the interviewee said the operation took security seriously and that vendors should never let their guard down. Less than three weeks later, the store's new address was replaced by a seizure notice.

The seizure

A screenshot of the new store from September 2021 showed a law enforcement notice replacing the storefront. The notice stated that the domain had been seized by the Dutch National Police in conjunction with Finnish Customs, the FBI and Europol. It also displayed the logo of the Netherlands Public Prosecution Service.

The key details were:

• Seized domain: e5fcylcyb76ltvx7tsm3uxiwfftdjhwealtzx7xb54mzftyg6ffjeqad.onion
• Date of seizure: 9 August 2021
• Authority named on the notice: Dutch National Police
• Other agencies named: Finnish Customs, FBI and Europol

A tor journal page also dates the seizure to 9 August 2021 under the title "NamasteLSD's Private Shop Has Been Seized". Darkipedia gives the same date but attributes the operation to Finnish law enforcement and states that the team had been arrested.

The vendor's subsequent disappearance is consistent with the earlier reports of inactivity. The main Dread account was later marked as banned, and a mid-2026 post asked administrators to delete subdreads created by /u/namastelsd_s, describing them as inactive with no moderators available. The records examined here contain no confirmed activity from either account after August 2021.

The Name Outlives the Vendor

The seizure provides a clear endpoint for the original store, but not for the NamasteLSD name. StealthMole's historical records contain multiple onion domains using the same branding in the years that followed. Some reproduced the original storefront, while others altered payment information or presented login pages without evidence of an operating shop.

The central question is whether these domains represent a return by the original vendor or an attempt by others to exploit its established reputation. The available records point towards the latter.

Imitation started before the seizure

A Darkweb Tracker search for DSLetsaman, the Reddit account associated with NamasteLSD, returned a Tor domain first collected by StealthMole in October 2020. Its pages closely reproduced the original store's news and FAQ content, but changes to the payment information exposed a critical difference.

• Lookalike domain: namawnpdio6gltks.onion
• Associated email: nam*************s@ema********r.com
• Bitcoin address: 1KRk*************************VKE

A comparison of the two stores showed that the lookalike had replaced the original Monero payment information with a string containing the Bitcoin address twice. The address had also been inserted into the PGP signature block, breaking it. The Dread link on the copied site pointed to a different domain from the one used by the original store.

These changes are consistent with a phishing proxy designed to reproduce the legitimate storefront while redirecting payments. The Bitcoin address and email should therefore be treated as indicators associated with the lookalike, not as evidence of NamasteLSD's own infrastructure. The domain's nama prefix also resembles the original brand, reinforcing the appearance of a connection.

Riding the vendor's own address

Another clone appeared around the time of the seizure. A Dread warning, preserved in a DarknetOne screenshot told buyers that a site using the address prefix e5fc3 was a clone and distinguished it from the legitimate store beginning e5fcy.

StealthMole's Telegram Tracker recorded the clone being advertised in the Hidden Links channel on 25 August 2021 and again on 7 September 2021, after the original store had been seized.

• Clone: e5fc3et2gcsvmii4f6mrjgapd22azni6iu6pm54m44aewfmohvvnnpid.onion
• Original store: e5fcylcyb76ltvx7tsm3uxiwfftdjhwealtzx7xb54mzftyg6ffjeqad.onion
• First recorded Telegram advertisement: 25 August 2021
• Telegram message ID: 1338296532_1455

The clone's address began with e5fc3et2, closely resembling the original store's e5fcy prefix. Its advertising also reused the NamasteLSD name and product descriptions. The same promotional wording, "NamasteLSD [Speed, LSD, MDMA, KETA, 2CB]", appeared on an Extreme Forum Marketplace profile in October 2021 and in a paste preserved in a leaked paste-site database.

StealthMole's captures from November 2021 to September 2022 showed the clone displaying a purple login page with the message "Welcome to NamasteLSD, don't let Covid limit your exploring!". The available evidence establishes that the site reproduced the vendor's branding, but does not identify who operated it.

The lookalikes that kept coming

StealthMole's records contain three further NamasteLSD-branded domains appearing after the original store's seizure.

• i6t3ocxt4lkwzi7aezlu4yf6ixkbbi6hbu4g73kxtmo3pqv4feuok2ad.onion
• lsd222xovelyemsqaa77w4cx4aqbjbr4rw5uazzfhlflxkjdvwutjnad.onion
• e5fc3et2tfadyw7zo4auu5qyjziob4qcmfwf6743eryaqpw4xvvcy5id.onion

The first domain was captured in April 2023 displaying the same purple login template as the earlier clone, including an identical captcha image. An onion-site list shared on Telegram in September 2023 labelled both as NamasteLSD.

The second domain continued to appear in link directories under the same name. MegaLinks still listed it as NamasteLSD.

• Domain: lsd222xovelyemsqaa77w4cx4aqbjbr4rw5uazzfhlflxkjdvwutjnad.onion
• Latest recorded directory capture: 15 October 2026
• Directory: MegaLinks

The third domain provides the most recent evidence of continued use of the brand.

• Domain: e5fc3et2tfadyw7zo4auu5qyjziob4qcmfwf6743eryaqpw4xvvcy5id.onion
• First recorded scan: 27 July 2026
• Latest recorded scan: 15 October 2026
• Page title: NamasteLSD
• Server banner: Apache/2.4.58 on Ubuntu
• Footer: ©NamasteLSD 2027
• Status at the last scan: Offline

The site displayed the same purple login form found on earlier clones. Its address also shared the exact eight-character prefix e5fc3et2 with the 2021 clone. The repeated prefix and shared template suggest a connection between the two sites, although the evidence cannot establish whether they were operated by the same person or whether a later operator deliberately copied the earlier clone.

The pattern is more consistent with the continued reuse of NamasteLSD's branding than with a verified return by the original vendor. None of the captured sites provides evidence of a functioning storefront beyond the login pages, and the available records contain no content signed with the original vendor's known PGP key.

Conclusion

The seizure of NamasteLSD's private store on 9 August 2021 marks the clearest dividing point in the investigation. Before the takedown, the store, PGP signatures, forum accounts and customer discussions documented a European operation that had expanded across darknet markets, a private onion store and Telegram. The records also showed that several people appeared to be involved in customer support and shipping.

After the seizure, the evidence changes. NamasteLSD-branded sites continued to appear, but the investigation found no verified sign that the original operator had returned. Instead, the later domains reproduced the store's branding and, in some cases, its address structure, while one earlier copy altered payment details in a way consistent with phishing.

The distinction is important when assessing whether NamasteLSD is still active. The original operation cannot be confirmed as active, even though the name continued to circulate in October 2026. The strongest way to verify a claimed connection to the original vendor would be to check it against the established PGP identity. None of the post-seizure material examined in this investigation provided that confirmation.

Editorial Note

Dark web investigations rarely provide a complete picture. Stores disappear, accounts are banned and familiar names can continue circulating long after the people behind them have stopped operating. In this case, archived store pages, forum discussions and indexed files helped establish the original vendor's activity and distinguish it from later copies.

The operators behind those copies remain unidentified, and the available evidence does not resolve every connection. StealthMole's historical records made it possible to trace how the NamasteLSD name persisted, while keeping the original operation separate from activity that could not be reliably attributed to it.

To access the unmasked report or full details, please reach out to us separately.

Contact us: support@stealthmole.com