Analysis of Public IP Infrastructure Associated with the Russian Drug Trafficking Group Stuffman
By Threat Intelligence Unit
Executive Summary
- ARTHUR identified public IPs associated with Stuffman, including infrastructure first detected on September 14, 2025
- Stuffman later placed stuffman[.]io behind Cloudflare WAF/CDN, so DNS no longer points to the origin server
- Reuse of previously detected infrastructure identified a non-Cloudflare address, 185.247.***.***, hosted on FlokiNET in Iceland, that served the same Stuffman homepage
- Stuffman operates a clearnet site and onion service, and sells through Russian-speaking marketplaces including KRAKEN, where it is marked as a trusted store with more than 100,000 transactions
Site Analysis
Stuffman is an online drug sales organization primarily active in the Russian-speaking community. It operates both a clearnet site and a Tor-based onion service, and publishes operational information including recruitment, income estimates, usage rules, dispute and compensation procedures, and cryptocurrency exchange rates.
Access Information
- Onion Domain: stuffmanh6q5nitusw6qhvxwcxzz3jb7ixeshgb5kqbaqaqjanlpxpqd.onion
- Clearnet Domain: stuffman[.]io
Figure 1. Stuffman onion service homepage
Search engines have indexed internal operational material associated with Stuffman.
Figure 2. Indexed search result exposing Stuffman internal registration guidance
An internally used work manual exposed in those results describes procedures across the organization's operations, including product receipt and storage, repackaging, on-site placement, marketplace registration, work reporting, buyer support, and fund withdrawal.
Figure 3. Exposed internal work manual covering operational procedures
The Загрузка кладов на витрину магазина (registering stashes for store display) section lists KRAKEN and BlackSprut as sales platforms, indicating that Stuffman uses external dark web marketplaces as sales channels.
Figure 4. Work-manual instructions for listing stashes on KRAKEN
KRAKEN is a major Russian-speaking dark web marketplace. Stuffman is marked there as Доверенный магазин (trusted store) and has recorded more than 100,000 cumulative transactions.
- KRAKEN: oqntbuzxn6lup2cghb4pif3yjy5btdw5unx357eptfbx33ywmptm6fad.onion
Figure 5. Stuffman storefront on KRAKEN marked as a trusted shop with more than 100,000 transactions
Product listings associated with Stuffman include cocaine, methamphetamine, mephedrone, hallucinogenic mushrooms, and LSD-25.
Figure 6. Stuffman product listings including cocaine, methamphetamine, ketamine, and LSD-25
Infrastructure Analysis
Public IP Identification
ARTHUR identified domains and IP infrastructure associated with Stuffman. The addresses currently returned for stuffman[.]io belong to WAF/CDN infrastructure and are not assessed as the origin server. Earlier detections and mapping records still provided a path to associated infrastructure.
As of August 23, 2026, ARTHUR associated stuffman[.]io with the following Cloudflare infrastructure:
- Domain: stuffman[.]io
- Public IP Address: 104.21.56[.]192
- ASN: AS13335
- Network: CLOUDFLARENET
A DNS lookup of stuffman[.]io returned two addresses, 104.21.56[.]192 and 172.67.155[.]207, both on Cloudflare WAF/CDN infrastructure. Stuffman is assessed to be using Cloudflare's reverse proxy so that external requests pass through Cloudflare and the public IP of the origin server is not exposed through DNS.
![DNS lookup of stuffman[.]io returning two Cloudflare addresses](/blog-images/260914_dw/7__.webp)
Figure 7. DNS resolution of stuffman[.]io to Cloudflare addresses
Additional analysis of external information related to stuffman[.]io identified a public IP that does not belong to Cloudflare: 185.247.***.***.
- Public IP Address: 185.247.***.***
- Country: Iceland
- Hosting Provider: FlokiNET
Direct access to 185.247.***.*** returned a service screen identical to the Stuffman homepage, indicating that the address is used as infrastructure directly associated with the Stuffman service.
Figure 8. Stuffman homepage served directly from 185.247.***.***
ARTHUR detections from September 14, 2025 show that 185.247.***.*** was previously identified as a public IP associated with Stuffman.
Response data collected from 185.247.***.*** on September 11, 2025 also contained the Stuffman onion address in external server-search results, including an Onion-Location header.
Figure 9. September 11, 2025 scan showing Onion-Location for the Stuffman onion address
A later scan on August 25, 2026 still associated the same address with Stuffman.
Figure 10. August 25, 2026 scan still associating 185.247.***.*** with Stuffman
Stuffman currently uses Cloudflare in a way that makes the origin harder to identify from DNS alone. Server information exposed before that WAF/CDN configuration, and later reuse of the same address, remained visible in internet scans and prior ARTHUR detection records.
Conclusion
Stuffman operates as a Russian-speaking drug trafficking service with both Tor and clearnet presence, and uses external marketplaces such as KRAKEN as additional sales channels. DNS for stuffman[.]io now terminates at Cloudflare, but earlier ARTHUR detections and direct access to 185.247.***.*** identified infrastructure still serving the same site.
The case shows that placing a service behind WAF/CDN does not remove earlier origin exposure when the same address is reused and remains in scan data.