Vendor Vetting From Scratch: Reading Feedback Patterns, PGP History, and Listing Age

Most vendor failures aren’t dramatic. Nobody gets robbed at gunpoint in a parking lot. The scam is usually a slow drift: feedback that looks fine on the surface, a PGP key that quietly changed six weeks ago, a listing that went from 90 days old to “new” overnight because the account was recycled. You catch it by reading patterns, not by trusting a green badge.

This is a working method for vetting a vendor you’ve never touched, built from the signals that are actually visible if you know where to look. Research only. I’m not going to point you at any market, and none of this should be read as an access guide.

Feedback is a dataset, not a mood

Marketplace reputation is rendered as a review score, and the scripts behind those scores track disputes and chargebacks against it, auto-suspending vendors who accumulate too many (sosintel.co.uk, marketplace script analysis). That’s useful, but it means the score is the thing the vendor optimises. The raw feedback text is where the signal lives.

Read it in bulk. Sort by date, not by rating. What you want to see is variance: a wall of identical five-star one-liners posted the same week is a manufactured pattern. Dread’s karma and review culture works the opposite way. Real reputation builds slowly and pseudonymously over time, and continuity of identity is provable through PGP (torwiki.org/forums). A vendor whose feedback has texture (complaints about shipping to a specific country, a dispute that got resolved, a product that arrived late but arrived) reads like a human business. Uniform praise reads like a farm.

The patterns that matter

• Account age versus feedback density. A three-month-old vendor with 200 reviews is either extremely busy or extremely fake. Cross-check against stock levels and listing count.
• Single-source vouching. The carding-forum advice generalises here: if every positive vouch comes from accounts created in the last week, they’re the same person. Cross-verify across independent communities, not one board.
• Proof quality. Cropped or edited screenshots hide things. The same “proof” screenshot reused across listings is a tell. Reverse image search it.
• Dispute handling. Look for whether disputes appear at all. A vendor with zero disputes in a year is more suspicious than one with a handful and a public resolution record.

Those proof rules come from a fraud-prevention write-up on carding proofs (theintelhub.com/carding-proof), but the logic is universal. A claim without a verifiable artefact is theatre.

PGP history: what the key actually proves

This is the part people skip. PGP does two different jobs. It encrypts messages, and it signs them. For vendor vetting, the signing side is the one that matters.

A legitimate operation publishes signed messages. Directories sign their .onion link lists so you can mathematically verify the link came from the real admin, not a hacker who compromised the server (theintelhub.com/tor-taxi-dark-fail-verified-onion-links/). Market admins do the same with canary messages at regular intervals, proving continued control and non-compromise (torwiki.org/forums). Vendors sit one level below that, but the same principle applies: if a vendor signs their PGP-signed ann