Intelligence from the underground. Action from above.
Our analysts track Telegram shopfronts, vendor bot networks, and cryptocurrency settlement infrastructure across 27 jurisdictions. Verified evidence packages are routed directly to registrar abuse desks, hosting compliance teams, and relevant public authorities under DSA Art.16 and national narcotics legislation.
Submit a report →Independent threat intelligence for public safety
Darknet Intelligence operates a dedicated collection and analysis pipeline targeting Telegram-embedded narcotics distribution networks. Our work supports registrar compliance teams, hosting abuse desks and public authorities by providing timestamped, archive-backed evidence packages that meet the evidentiary standard required for suspension actions.
Continuous Monitoring
Automated and manual collection across Telegram channels, bot storefronts, and invite-gated vendor groups — 24/7 coverage across the platform.
Evidence Packaging
Every finding is timestamped, archived via the Wayback Machine, and cross-referenced against WHOIS/RDAP, hosting data, and crypto address clusters.
Structured Reporting
DSA Article 16-compliant notices filed against the correct counterparty — registrar, hosting provider, or platform — with verifiable evidence chains.
What we track and report
Our monitoring focuses on the highest-harm categories where Telegram has become the dominant storefront.
Controlled Substance Distribution
Automated Telegram shopbots and invite-gated channels trading cocaine (Class A), MDMA (Class A), heroin/opioids (Class A), benzodiazepines (Class C), cannabis (Class B), and psychedelics — primarily UK-to-UK delivery with Monero settlement.
Crypto Payment Rails
Bitcoin, Litecoin and Monero payment flows across vendor networks. Address clustering links shopfronts to shared infrastructure. Cross-chain swap tracing maps conversion paths through non-KYC exchanges to operator wallets.
Infrastructure & Hosting
Domain registration patterns, bulletproof hosting networks, CDN abuse vectors, and mirror-domain operations that sustain marketplaces after takedowns.
Counterfeit & Fraud Operations
Pharmaceutical counterfeits, payment fraud schemes, credential harvesting networks, and brand impersonation campaigns.
Proven results
Since inception, Darknet Intelligence has filed over fifty verified abuse reports resulting in direct action by registrars, hosting providers, and platform compliance teams. Our evidence packages consistently meet the evidentiary threshold for suspension and removal.
Targets include illicit narcotics marketplaces, counterfeit pharmaceutical operations, crypto-enabled vendor networks, and infrastructure abuse vectors across the Telegram ecosystem. Individual case details are withheld to protect operational integrity.
Grounds for action
Our reports are framed against the legal instruments that receiving desks and authorities actually enforce.
📧 Submit Intelligence
If you have identified an illicit marketplace, vendor operation, or infrastructure abuse vector, submit your evidence below. All submissions are reviewed by our threat intelligence team and handled with strict confidentiality.
Include URLs, evidence, and relevant context. PGP key available upon request. We respond within 48 hours.
Compose Report →