Archive / Recovered captures
What survives
The servers were decommissioned in 2015 and the drugs were destroyed. What is left is a handful of web captures - almost all of them on this domain, which is the only address anywhere with surviving shop content - and they are more informative than they look.
The takeover page, 11 March 2015
On the afternoon of 11 March 2015 the Leipzig police did not simply pull the plug. They kept a domain serving and put their own page on it. A crawler caught it at 20:16:31 UTC. The entire document is nine lines long, and every one of them is doing something.
This page appeared on shiny-flakes.to, a domain not held by this archive and never connected to it. It is documented here because it is a matter of public record and because, as far as this archive can establish, the source has not been published before. No shop content of any kind survives on that domain - the domain history is set out here.
The title is Sorry :-(, which German reporting at the time described as faintly smug and which is difficult to read any other way. The comment - YOUR ACCESS HAS BEEN TRACKED - is invisible to a visitor and visible to anyone who views source, which in March 2015 was precisely the audience worth frightening. Whether it was true is a separate question and rather beside the point.
Then the page itself: not a seizure notice, not a warning, but a recruitment advert.
The joke is deliberate and it is a good one. A pun on verdächtig - suspicious, or suspiciously - deployed on a domain that had until three weeks earlier been Germany’s largest online drug shop, aimed at exactly the sort of technically capable young person who might have been browsing it.
And then the detail this archive has not seen remarked on anywhere. Underneath the advert sits a link marked Impressum. German law requires the operator of a website to publish their identity and contact details. The Saxon police were now the operator. So they complied.
The user-facing page carried no seizure language at all. Forbes reported at the time that the seized site displayed “DO NOT BUY HERE. VENDORS RUN FOR YOUR LIFE”, which does not appear in the archived capture of shiny-flakes.to; that wording most likely belongs to the onion site or to another seizure in the same sweep. This archive can only vouch for what is in the capture.
The shop, and what it was built from
Reading the page source of the 2014 captures gives a straightforward technical profile. It is worth setting out because the popular account of this case - dark web, criminal mastermind - is contradicted by the markup.
| Component | What the source shows |
|---|---|
| Platform | WordPress |
| Commerce | WooCommerce 2.1.12 |
| Theme | Maximize - 3.8.2 (May 2014) → 4.0 (Sept) → 4.0.1 (Dec) |
| Network | Cloudflare (cdn-cgi asset paths present) |
| Hosting | Netherlands, per Vice |
| Registration | Tonga (.to), per Vice |
| Onion mirror | ra6falaruvgwbmpj.onion |
| Contact | shiny@shiny-flakes.com, PGP key at /SHINY_PUBLIC_KEY.txt |
| Still exposed | xmlrpc.php, RSS feeds, wp-admin/admin-ajax.php |
The theme was kept patched. XML-RPC was left switched on. Both are entirely typical of a competent amateur running a WordPress site in 2014, which is what this was.
Three things the markup gives away
1. The week the SEO started
The May 2014 capture has no meta keywords tag. The September capture does, carrying kokain, meth, mdma, xtc, lsd, speed, drogen, cocaine, crystal, emma, ecstasy and the shop’s own name. Somewhere in that window, being findable started to matter more than being discreet.
That four-month window has since been narrowed to a single week, from an entirely separate record. The shop submitted its first sitemaps to Google on 24 August 2014, and the submission survives in Google Search Console because that history attaches to the domain rather than to the account that made it. It also ran a dedicated image sitemap, which exists for one purpose: getting photographs into Google Images. The Search Console record is here.
2. When cannabis left the range, and when it came back
The page title doubled as the product list, so its edits track the shop's strategy:
| Capture | Product list in the title tag |
|---|---|
| 4 May 2014 | Kokain / Meth / MDMA / XTC / Weed / LSD / Speed |
| 17 Sep 2014 | Kokain / Meth / MDMA / XTC / LSD / Speed |
| 14 Oct 2014 | Kokain / Meth / MDMA / XTC / LSD / Speed |
| 4 Dec 2014 | Kokain / Meth / MDMA / XTC / Hasch / Speed |
In the September interview the operator said cannabis had been dropped after about four weeks because the margin did not justify the support load. The title tag corroborates that independently: Weed is there in May and gone by September. By December Hasch had taken its place, and the catalogue shows cannabis itself back on the shelf as a single 900-euro bulk unit. The interview is here, and the catalogue here.
3. Claims revised and forgotten about
WordPress mints a permalink from the title when a product is first published and then never updates it. Comparing the 4 affected URLs against the titles in the same 4 December 2014 capture shows claims that changed after publication - a purity figure lowered, a dosage widened, a second dosage raised, one purity claim removed entirely. The table is on the catalogue page.
What is not in the archive
Worth stating plainly, because absence is evidence too. There is no archived checkout page, so no bitcoin address survives - which is why this site does not attempt a blockchain trace. The PGP public key at /SHINY_PUBLIC_KEY.txt was never captured. A file called cocaine_batch_info.txt was requested by a crawler in September 2014 and returned 403, so we know the shop published batch documentation and not what was in it. The onion shop is absent entirely, as onion services always are.