Official URL — bookmark it to avoid phishing clones:

• Clearnet: https://dfstore.to
• No Tor mirror. DF-Store runs on the clearnet only. Any .onion address claiming to be DF-Store is a phishing clone.

What is dfstore.to?

dfstore.to — branded as DF-Store — is a German clearnet vendor that has been operating for over three years and now markets itself as a "Stealth-Shop der neuen Generation" (next-generation stealth shop). It runs on a custom single-page storefront behind an aggressive Cloudflare bot challenge, which sets it apart from the disposable WordPress and WooCommerce templates typical of exit-scam operations. The catalogue has grown well beyond its cannabis roots: alongside multiple weed categories (Standart Weed, Spain Weed, "Kanada Cali", Hash and THC edibles) it now carries a full "Chemie" range covering MDMA, cocaine, ketamine, 2C-B, 3-MMC, LSD, XTC pills, speed and GBL.

The vendor accepts cryptocurrency exclusively, routed through Trocador AnonPay (Bitcoin, Ethereum, Litecoin, USDT and TRON are shown at checkout), encrypts every order in the buyer's browser with client-side PGP, ships from Germany via DHL across the EU, and enforces a €100 minimum order. It has an active presence on the cstate.to community forum, where user reports corroborate delivery claims — though, as noted below, that feedback is not fully independent.

How to verify you are on the real site

DF-Store is a known target for phishing clones, and because payments are irreversible crypto, sending funds to a fake checkout means permanent loss. Verify the domain carefully before ordering.

Check the address bar for an exact match: dfstore.to. Watch for lookalike domains — digit-for-letter swaps, added hyphens, or different TLDs (.com, .shop, .net). On first visit you will see a Cloudflare "Sicherheitsüberprüfung" (security check); that is expected on the real site and is not itself a sign of a clone.

Remember that DF-Store is clearnet-only. There is no Tor mirror, so any .onion address presented as DF-Store is fake. The genuine checkout never asks for an exchange login, a wallet seed phrase, or an email password — only a delivery address and a Trocador crypto payment. Bookmark the verified URL after your first visit and never follow links from Telegram groups, Reddit DMs, forum signatures or sponsored search results.

Product range and pricing

The shop is organised into cannabis categories and a chemical ("Chemie") section, with bulk-tiered pricing and a €100 order minimum. Prices below are the vendor's own listings and decrease with quantity.

Cannabis (per gram): a rotating strain list including Black Runtz, King Star, Pink Runtz, Vice City, MOB, Fun Dip, G13, AK47, Mandarin, Banana, C-Max, Gorilla and Haze, roughly €2.80–4.50/g, with imported "Cali" flower (Cali Plates, Lamousse Tropicana) around €16.50/g. Separate Spain Weed, Hash and THC-edible ("Dry Früchte") categories exist.

Chemie (vendor-stated purity in brackets): MDMA "Pepsi" (95%) from €10/g down to €4/g in bulk; Peruvian cocaine (95%) €55→30/g; Bolivian cocaine (94%, uncut) and Colombian cocaine (92%) from ~€30/g; ketamine S-isomer (needles and rocks) ~€2.20–3.30/g; 2C-B pills ("Raketen"); 3-MMC (98%); LSD blotters (150 µg); XTC pills (Pop Grün / Pop Lila, 280 mg); speed paste (uncut, ~€1/g); and A-Oil (GBL, sold per ml).

Purity percentages are vendor claims shown on the listings; we have not independently lab-tested any product. The very low bulk pricing and €100 minimum indicate the shop is oriented toward larger and resale-scale orders rather than single grams.

Security and payment

DF-Store's privacy engineering is the most distinctive thing about it, and it is genuinely above the clearnet norm:

• Client-side PGP encryption. When you submit an order, JavaScript in your browser encrypts the entire payload — delivery address, contact handle, products, quantities, prices, your note, the payment ID and a timestamp — against the shop's public PGP key before anything is transmitted. Only the order number travels in clear. The server stores ciphertext it cannot read; only the operator's private key (kept, per the site, on air-gapped systems with deletion after fulfilment) can decrypt it. The site even documents how to confirm this yourself in the browser's Network tab (the order.php request shows a -----BEGIN PGP MESSAGE----- block).
• Anonymous payment via Trocador AnonPay. Payments are routed through Trocador, which forwards the funds so the shop never sees your originating wallet. On-chain, the trail reads "your wallet → Trocador," and the Trocador → shop leg is not linked back to you. You can pay with Bitcoin, Ethereum, Litecoin, USDT or TRON.

A crucial caveat: this stack protects your privacy, not your money. There is no escrow. Once your crypto is sent, your only recourse is the vendor's willingness to resolve a problem. Strong encryption and a clone-resistant payment flow do not change the fact that you are extending upfront trust.

Shipping and packaging

DF-Store's logistics are more clearly documented than most clearnet shops:

• Carrier: parcels via DHL only.
• Dispatch: same day or by the next working day per the FAQ; the terms (AGB) state shipping within three working days.
• Delivery estimates: 1–4 working days within Germany; 3–7 working days elsewhere in the EU.
• Tracking: provided on request, no earlier than two days after dispatch — the vendor deliberately avoids handing out tracking that creates an early paper trail.
• Destinations: all 27 EU countries are listed (Germany, Austria, Benelux, France, Spain, Italy, Portugal, Poland, the Nordics, the Baltics, and the rest of the bloc). Orders outside the EU must be arranged through the support form.
• Packaging: described as discreet, with unobtrusive wrapping and neutral sender details.
• Anti-fraud: every order is screened; orders flagged as fraudulent are not shipped and those accounts are permanently banned.
• Claims policy: to file a complaint about quantity or product, the vendor requires a single continuous video of the entire unboxing. Without it, claims are not processed. DF-Store also disclaims liability for DHL handling, wrong address/recipient details, overfull parcel lockers (Packstationen), and crypto sent from an exchange that confirms too slowly and misses Trocador's payment window.

Community validation and risk assessment

The strongest point in DF-Store's favour is longevity plus a multi-year cstate.to track record — a pattern that is expensive to fake and sustain. The privacy infrastructure (client-side PGP, Trocador AnonPay, air-gapped decryption) is a real and unusual investment, and the EU-wide DHL operation with documented timelines reads like a working logistics chain rather than a placeholder.

The important caveat is independence: the bulk of DF-Store's positive feedback originates on cstate.to, and there are unverified claims that cstate.to and DF-Store may share ownership or financial ties. That means the community validation cannot be treated as fully independent third-party verification, and we rate the vendor cautiously as a result. Add the structural risks — clearnet-only with no Tor mirror, no escrow, a €100 minimum that raises the stakes of any single order, and an unusually demanding claims process (mandatory unboxing video) — and the picture is of a competent, privacy-focused operation that still requires upfront trust. The aggressive Cloudflare gate and the existence of phishing clones make domain verification non-optional.

OPSEC for buyers

Use a no-logs VPN every time you visit, since the site is clearnet-only and exposes your IP otherwise. Pay from a private wallet rather than directly from a KYC exchange — this is both an OPSEC measure and a practical one, because DF-Store warns that exchange-originated payments can confirm too slowly and fail Trocador's time window, with no liability for the lost funds. Where the payment flow allows it, prefer a privacy coin.

Provide only what the postal system needs for the delivery address; first name and surname are usually sufficient. Choose one encrypted contact channel (Session, Signal, Telegram or Threema) and keep all order discussion there — never over cleartext email, SMS or social media. Expect support replies within about 24 hours on working days. Keep the unboxing video the claims policy requires, but store it offline and never upload it anywhere that ties it to your identity. If an order runs past the stated window, wait a few extra days before reaching out through your chosen encrypted channel.