International clearnet drug scam networks exposed — 2026

The fake review blog → "verified shop" pipeline is running in every major European language. This investigation maps the networks we identified in English, French, Dutch, and Spanish-speaking markets.

TL;DR

• The fake review blog → "verified shop" pipeline is active across English, French, Dutch, and Spanish-speaking markets.
• All share the same DNA: WordPress blogs with a newspaper theme, a single admin authoring glowing "reviews," crypto-only payment, no escrow, and zero accountability.
• Named networks include darknetreview.com / drugbuyersguide.info (English), acheterdroguee.com / mygrams.eu (French), medicijnenonline.com and Telegram-based scams (Dutch), and ordercocainonline.com / narcopowders.com (Spanish/international).
• Losses are unrecoverable (crypto payments have no chargeback mechanism, and victims rarely report because they were attempting illegal purchases.)

The playbook

Every network we investigated follows the same five-step model:

1. Build a review blog. WordPress with a news theme (News Hunt, flavor variants of flavor theme) gives editorial credibility. A single admin account publishes all content.
2. Create 3–6 "shops". Separate domains selling substances at believable (but still high) prices. Crypto-only payment. No escrow. Minimum orders designed to maximize per-victim take.
3. Cross-promote. The review blog "independently verifies" its own shops. Copy-paste errors and shared hosting reveal the connection.
4. SEO + social. Instagram, TikTok, Facebook ads, and Telegram channels drive traffic to the blog, which funnels into the shops.
5. Harvest and ghost. Collect crypto payments, personal data (names, addresses, phone numbers), then deliver nothing. Victims can't complain to police without admitting attempted illegal purchase.

English-language networks

darknetreview.com

Presents itself as an independent marketplace review platform. Publishes reviews of clearnet drug shops like crystalmethforsale.com (crypto-only, selective scamming on orders over $150–200). The review format uses star ratings, "verified" badges, and purchase walkthroughs to simulate editorial credibility.

drugbuyersguide.info

A forum-style site where user "reviews" direct traffic to shops like teamchemists.com — a crypto-only operation where buyers report being ghosted after payment, with no shipping confirmation despite month-long waits.

Shared pattern indicators

French-language networks

acheterdroguee.com

Flagged by FranceVerif with a trust score based on 127 criteria indicating "fiabilité douteuse" (dubious reliability). The site uses WooCommerce (WordPress) to create a storefront appearance. Zero verified customer reviews. Extremely low popularity score (1/100).

mygrams.eu

A WordPress + WooCommerce operation scoring 54/100 on trust metrics. Displays pharmaceutical and drug-related sales signals. The crypto payment flow forces buyers to purchase cryptocurrency via iDeal before sending to the "shop" — adding a layer of obfuscation that makes chargebacks impossible.

Telegram pipeline (France)

French-speaking scammers on Telegram use prepaid card payments (PCS, Paysafecard) alongside crypto. They share stolen Google Images as "proof of stock." Community warnings on Psychoactif.org document the pattern extensively. In May 2026, French police dismantled an organized network in Bouches-du-Rhône that operated a darknet boutique delivering via parcel lockers.

Dutch-language networks

medicijnenonline.com

Documented by AVROTROS Opgelicht! (Dutch consumer protection), this site targets Dutch buyers seeking Ritalin, steroids, erectile dysfunction medication, and Ozempic. Accepts crypto, delivers nothing.

The Netherlands: scale of the problem

The Dutch Health Inspectorate (IGJ) recorded 187 reports of illegal online pharmacies in just the first 10 months of 2025, up from 114 in all of 2024. Key findings:

• Average fake pharmacy stays online 20 months (vs. weeks for normal fake shops) (victims don't report due to illegality of their purchase.)
• Counterfeit oxycodone pills containing nitazenes (up to 1,000× stronger than morphine) have caused multiple deaths.
• Dutch consumer watchdog Consumentenbond specifically warns about the crypto-to-payment bridge that makes all transactions irreversible.

Spanish / international networks

ordercocainonline.com

Trust score: 1/100 (ScamAdviser & GridinSoft). Registered recently, uses WordPress. Accepts cryptocurrency and anonymous payments. Blacklisted by security providers for phishing. Hidden WHOIS ownership.

narcopowders.com

Trust score: 5/100. Uses stolen product images, unrealistically low prices, and a WordPress storefront. Zero customer reviews anywhere outside its own platform.

Why this model persists

Three structural factors make this scam model nearly unkillable:

1. Victim silence: Buyers attempting illegal purchases don't file police reports. Dutch research shows fake pharmacies survive 10× longer than normal fake shops for this reason.
2. Crypto irreversibility: Bitcoin/Monero payments cannot be charged back. No payment processor protects the buyer.
3. Low hosting costs: A WordPress blog + WooCommerce shop costs under €50/year to operate. Even a 1% conversion rate on SEO traffic is profitable at 0 fulfillment cost.

How to identify the pattern

Any site matching 3+ of these criteria is almost certainly a scam:

• ❌ WordPress blog with a "newspaper" theme reviewing drug shops
• ❌ Single author account writing all reviews
• ❌ "Verified shop" badges with no verification methodology described
• ❌ All promoted shops accept crypto only
• ❌ No escrow, no refund policy, or deliberately vague terms
• ❌ WHOIS privacy on all connected domains
• ❌ Domains registered within weeks of each other
• ❌ Shop URLs follow a [substance]-buy/acheter/kopen naming pattern
• ❌ Reviews reference competitor substance shops by mistake (copy-paste errors)
• ❌ Social media promotion via throwaway accounts

Protect yourself

1. No legitimate vendor operates on the clearnet without escrow and dispute resolution. If a site asks for direct crypto payment to a wallet address: it's a scam.
2. "Review blogs" that only review positively are not reviews — they're ads.
3. Check domain age and registration patterns using ScamAdviser, WHOIS lookup, or Watchlist Internet.
4. Never send identifying data (real name, address, phone) to any of these sites. This data is harvested and may be used for extortion.
5. Telegram/Signal "vendors" requesting prepaid cards or crypto upfront are scammers with zero exceptions documented.