After the Silk Road got shut down by the Feds, many replacements popped up, all vying to take their place at the top of the illegal drug trade pile. One of these sites was Project: Black Flag.

Launched on 14th October 2013 not much was known about this project only that its aim was to be a replacement for Silk Road and is run by a character known as “Metta Dread Pirate Roberts” who appears was not involved in the running of the old site but is building a new site in its image with same policy’s and features meaning no weapons, counterfeits or stolen goods. MettaDRP may have had access to Silk Road’s old DB or source code.

Well, our good pirate friend just made off with all the booty! Yarrrrrr!!

Thanks for the coins suckers! You’re on your own now.

I don’t know how these idiots keep falling for it again and again.

Don’t worry though, some anonymous internet tough guys are on the case!

This comment comes from the thread.

I know everything.

I know who you are. More specifically, I know your consumer IP address, your name, your age, and your place of birth. You have not configured your Tor correctly, by the way.

I was able to gain access to the server shortly after you put it up.

I know you used an Ubuntu machine running Apache 2.2.22 on port 4986, binded to 127.0.0.1. Binding to localhost doesn’t magically solve all your security problems, by the way.

I know you used an outdated version of phpMyAdmin to access the PBF database and perform searches and maintenance tasks. I know had set up a crontab to periodically curl http://ajd4yqq7ngzmqo3p.onion/cron.php. I know you also set up testing scripts on multiple occasions, at http://ajd4yqq7ngzmqo3p.onion/tt.php(PHPCoinAddress test) and http://ajd4yqq7ngzmqo3p.onion/ttt.php (pathetic code with a very insecure method of “tumbling” coins).

More importantly, I know you exported the “sr” database in phpMyAdmin right before the purge. And I know you backed up www.tar.gz to http://ajd4yqq7ngzmqo3p.onion/www.tar.gz. Unfortunately for you, both of these dumps are in my possession.

I recorded all transfers you sent through the bitcoind RPC interface. I have not yet filtered these transactions but it should not be difficult.

Some of the addresses: – 1ABkVAMaLZZFZ4w4zWqTYZnLZBXTfYLKBh – 19YrMzTFJBBvDpv43Bi9nbTPewY7jLqdTK – 1PfDu6ki4XLd7TPBJjih6wY3yzyBaG1h6N – 15Bvuuzu4LtaDc5HKHzK4YCK8TqEftgRVR – 14YpbZ49oqq6pss28WJnjBvQDXhNSGrYXL – 1Ns3GvhgeP8uK6ht3xzZC64xUaZVwygX2y

The database dump I downloaded contains these tables: – orders – users – market – items – messages – navigation – wallets – feedback – bonds – bookmarks

You have 24 hours to respond to this post. If this post is deleted, I will take it personally.

I’m sure that IP will do a lot of good when you tell the cops that some dude stole your money from drug buying website. Chief Wiggum will get right on that!