Building a Vendor Watchlist: Tracking Handles, Key Rotations and Reputation Drops Over Time

A vendor watchlist is useful only if it records uncertainty as carefully as it records identity. Handles change. Public keys are replaced, revoked, or copied. Reviews can be manipulated. A sudden drop in activity may indicate a scam, a market outage, or nothing more than a vendor abandoning an account.

This makes longitudinal tracking a research problem, not a simple spreadsheet exercise. The goal is to compare observations over time without turning a weak signal into an accusation. This article is for defensive research, journalism, and threat intelligence. Do not contact vendors, place orders, send funds, or visit live illicit markets.

Define the object you are tracking

Start with a vendor record, not a person record. A handle is an observed label attached to an account. It is not proof of a real-world identity, location, or relationship with another account.

A useful record can contain:

• Market or forum name, recorded as a source label rather than a recommendation.
• Observed vendor handle, including exact capitalization and unusual characters.
• First and last observation dates.
• Public key fingerprint, if a key was published.
• Key creation, expiration, revocation, and replacement observations.
• Listing categories, general service area, and stated policies.
• Review totals, rating changes, dispute references, and visible warnings.
• Evidence source, capture date, and confidence level.

Keep the original observation separate from your interpretation. “Handle changed from X to Y” is an observation. “The same operator migrated accounts” is a hypothesis.

Use a confidence model

Identity continuity should be scored by evidence quality, not by visual similarity. The strongest link is usually a signed statement made with a previously known private key, provided the old key was itself well established. A matching vendor description is weaker. A matching avatar is weaker still.

One practical classification is:

• Confirmed continuity: the new account publishes a verifiable statement signed by the previously observed key, or the market provides a reliable account migration record.
• Probable continuity: several independent attributes match, such as writing style, product scope, policies, and a key fingerprint, but no strong cryptographic proof exists.
• Possible continuity: the handle, avatar, or wording resembles an earlier account.
• Unrelated or unknown: evidence is absent, contradictory, or contaminated by impersonation risk.

This conservative approach matters because reused names and copied profiles are common risks in pseudonymous systems. Username enumeration guidance also treats avatars, biography details, and account creation dates as corroborating signals, not standalone proof. The same principle applies here.

Capture evidence before interpreting it

Dynamic pages are poor research records. Listings disappear, review counts change, and market interfaces can be altered without notice. Preserve the smallest useful evidence set for each observation.

• Capture the page or dataset timestamp.
• Record the exact handle and displayed key fingerprint.
• Save relevant text, including profile claims and policy changes.
• Hash local evidence files so later edits are detectable.
• Record whether the material came from a first-party page, an archive, a forum repost, or a third-party report.
• Mark content that may contain copied or unverified claims.

Do not collect unnecessary personal information. A vendor watchlist should not become a doxxing file. Exclude names, addresses, phone numbers, shipping information, and payment identifiers unless there is a clear legal and defensive reason to retain them. In many cases, removing those fields improves analytical discipline.

For academic work, structured datasets can be more useful than browsing live services. One study analysed 851,199 listings from 30 dark web marketplaces between January 1 and November 16, 2020. Its value came from scale and temporal comparison, not from treating every listing as a verified identity. That is the right model for historical analysis.

Track handles as aliases, not identities

Handle changes deserve a timeline. Record the old label, the new label, the date of change, and the evidence connecting them. Do not overwrite the old value. Historical names are often the most important part of the record.

Useful handle signals include:

• Exact spelling and capitalization.
• Repeated phrases, formatting habits, and policy language.
• Stable product descriptions or category boundaries.
• Consistent claims about shipping, disputes, or replacements.
• References to an older account that can be independently verified.
• Timing of the change relative to market disruption or account suspension.

Writing style can help cluster observations, but it is easy to overrate. Templates are copied. Translation tools create false similarities. Vendors may deliberately imitate established accounts. Treat linguistic matching as supporting evidence and document the text used for comparison.

Avatars are especially weak evidence. They are easy to copy, and a familiar image can create false confidence. A matching avatar should increase interest, not identity certainty.

Key rotations need a separate timeline

Public key changes are more informative than cosmetic profile edits, but they still require context. A key may be rotated because of suspected compromise, lost credentials, operational policy, expiration, or an attempt to confuse observers. A new fingerprint alone does not prove continuity.

For each key, record:

• Full fingerprint, never just a shortened display value.
• First observation and last observation dates.
• Whether the key was marked expired or revoked.
• Where the key appeared.
• Any signed migration statement.
• Whether messages or profile text explicitly reference the replacement.

A strong rotation pattern is a signed announcement from the old key identifying the new fingerprint, followed by consistent use of the new key across later observations. Even then, preserve the original evidence. A copied announcement can circulate after a compromise.

Separate three events in your database: key publication, key use, and key verification. They are not the same. A fingerprint may be posted on a profile without ever being used to sign a message. A signature may verify mathematically while the account itself remains an impersonation.

Measure reputation as a time series

A single rating is nearly useless without its denominator and date. Reputation should be treated as a sequence of observations.

At minimum, record:

• Total visible reviews.
• Positive, neutral, and negative review counts, if available.
• Average score and the date captured.
• Dispute references and their apparent outcomes.
• Changes in listing volume or activity.
• Warnings from independent sources, clearly labelled as unverified.

Do not confuse a high score with safety. Market systems commonly use escrow, disputes, auto-finalization, and vendor status controls. One described marketplace model gives buyers a limited window, often five to fifteen days depending on configuration, to confirm delivery or open a dispute. Other systems may require finalization before that window closes. These mechanisms reduce some transaction risk, but they do not validate a vendor’s claims or protect against market-level failure.

Early finalization deserves special attention. A vendor being allowed to receive funds before delivery is a status change, not proof of trustworthiness. Terminology references describe this as FE, or finalization early, and distinguish it from ordinary escrow. Treat FE eligibility as an exposure indicator in the timeline, not as a positive reputation metric.

Detect reputation drops without overreacting

A reputation drop can be real, manufactured, or statistical noise. Compare changes against the observation window and review volume.

High-signal patterns include:

• Several independent negative reviews appearing in a short period.
• Repeated complaints with the same failure mode.
• Unanswered disputes followed by profile or key changes.
• Large changes in policy, delivery claims, or refund language.
• Positive reviews continuing while older negative reviews disappear.
• New account activity appearing before the old account becomes inactive.

Review deletion is difficult to interpret. It may reflect moderation, an archive change, or deliberate reputation management. Record the disappearance as an event. Do not label it manipulation unless the evidence supports that conclusion.

Look for base-rate effects. A vendor with three reviews can move from perfect to poor after one complaint. A vendor with hundreds of reviews may show a small percentage change that still represents a serious operational shift. Percentages without counts conceal this difference.

Watch for selective scamming

Reputation systems can fail in a particularly deceptive way when an account behaves normally for many users and then targets a smaller group. Terminology references describe selective scams as maintaining legitimate operations while defrauding certain users, sometimes concentrating on large orders or new buyers.

That pattern is difficult to prove from public reviews. Still, a watchlist can flag it for review when:

• Complaints cluster around unusually large transactions.
• Standard orders appear successful while premium or custom requests fail.
• Refund and dispute outcomes differ sharply by customer type.
• The account changes terms immediately before accepting larger commitments.

Use “pattern consistent with selective complaints,” not “confirmed selective scam,” unless independent evidence exists.

Distinguish vendor failure from market failure

Escrow creates a common analytical trap. It may protect a buyer from a vendor under ordinary dispute rules, but it does not protect funds held by the market operator. Market administrators control the escrow infrastructure, and an exit scam can remove balances from both buyers and sellers.

Vendor monitoring should therefore include market-level context:

• Payment delays affecting many accounts.
• Dispute queues becoming inaccessible.
• Unexpected changes to withdrawal or finalization rules.
• Widespread complaints across unrelated vendors.
• Sudden shutdowns followed by claims of a replacement mirror.

Historical references describe major market exit scams, including Evolution in 2015 and Empire in 2020. The lesson is structural. A vendor with an excellent record can still be caught inside a failed platform. Vendor reputation cannot eliminate custodial risk.

Build an evidence table that survives scrutiny

A simple schema is enough:

• Observation ID: unique local identifier.
• Date observed: use a consistent timezone.
• Source class: market page, archive, forum, dataset, or report.
• Handle: exact displayed value.
• Key fingerprint: full value where legally and ethically appropriate.
• Reputation state: counts, score, disputes, and visible warnings.
• Event type: rename, key rotation, policy change, review change, inactivity, or reappearance.
• Confidence: confirmed, probable, possible, or unknown.
• Analyst note: observation separated from inference.

Use immutable snapshots for source material and a separate working table for analysis. Corrections should create a new version rather than silently replacing the old record.

Set alert thresholds carefully

Automated alerts should identify records for human review, not declare wrongdoing. Reasonable triggers include a new key, a handle collision, a rapid review change, a sudden policy rewrite, or inactivity followed by a new account.

Do not automate identity accusations. False positives can harm uninvolved people, contaminate reporting, and encourage researchers to treat pseudonymous accounts as real-world subjects. A watchlist is strongest when it says exactly what is known, what is inferred, and what remains unresolved.

The practical verdict is simple: track transitions, preserve evidence, and distrust clean narratives. A stable handle can be hijacked. A new key can be legitimate. A perfect rating can coexist with selective fraud. Treat every record as a dated observation, and the timeline will tell you more than any single reputation badge.