Operation Darknet — Text of the OpDarknet press release timeline of events from October 2011

Operation Darknet

2011internet eventclassic

Published September 20, 2026

Operation Darknet was a 2011 Anonymous hacktivist campaign that used DDoS attacks and database leaks to take down child sexual abuse material hosted on Tor's hidden services. The operation crashed Freedom Hosting, exposed 1,589 usernames from a site called Lolita City, and set a template that Anonymous returned to in the 2017 Freedom Hosting II breach.

hacking memes protest memes cybersecurity memes early 2010s memes surveillance memes

Overview

Rather than a single hack, Operation Darknet ran as a chained series of named sub-attacks executed between October 14 and November 5, 2011, each one announced through PasteBin dumps and IRC channels5. The group combined denial-of-service floods against Freedom Hosting with database intrusions that pulled site membership lists, then dropped those lists as evidence2. Every phase carried a codename, including 'Chris Hanson' (spamming To Catch a Predator clips onto the compromised host) and 'Paw Printing' (a 24-hour honeypot phase)5.

The campaign's signature technical trick was a modified TorButton for Firefox called 'The Honey Pawt,' pushed only through the Hard Candy wiki, which logged the IP addresses of anyone who installed it to visit Lolita City5. Anonymous framed the whole effort in a video manifesto uploaded by the YouTube channel BecomeAnonymous on October 17, 2011, stating the target was CSAM hosting specifically, not Tor or the darknet as a concept8. That distinction mattered in early coverage, where security researchers warned the DDoS approach could taint evidence trails in ongoing police cases2.

Specific fan-made remixes of the operation are not archived in available sources; the campaign's primary artifacts are the group's own manifesto video8, the PasteBin communiques5, and the leaked Lolita City username list dropped on October 18, 20111.

Origin & Background

Platform
Tor hidden services (source) / PasteBin and YouTube (public spread)
Creator
Anonymous
Date
2011

The operation began in early October 2011 when Anonymous members noticed links to images of child sexual abuse on the Hidden Wiki, a Tor-based index of hidden services2. Members stripped the links, watched them get re-posted, and knocked the wiki offline with a denial-of-service attack while tracing where the linked material actually lived2. Nearly all of it shared a hosting fingerprint pointing to Freedom Hosting, at the time one of the biggest hosts of Tor-based sites1.

At 9 p.m. CST on October 14, 2011, the group issued Freedom Hosting an ultimatum to pull the material5. Freedom Hosting refused. Two and a half hours later, Anonymous knocked its services offline with a DDoS flood that included dropping a 1GB SQL payload and 100,000 ASCII Guy Fawkes masks onto the host every five minutes5.

How It Spread

When Freedom Hosting restored service on backup infrastructure around 5 p.m. CST on October 15, 2011, Anonymous re-attacked using a sub-operation codenamed 'Chris Hanson,' uploading episodes of To Catch a Predator labeled as CP files onto the compromised host5. Two days later, on October 17, the YouTube channel BecomeAnonymous posted the campaign's manifesto video explaining the target set and future plans8. The group then dropped the 1,589-username list from Lolita City to PasteBin on October 18, complete with upload counts and account ages, and invited Interpol and the FBI to work through the records1.

News picked up fast. The Examiner ran the story on October 20, Gawker followed on October 21, and the Huffington Post covered it on October 22 with a rundown of the leaked usernames4. Ars Technica detailed the group's claim that taking down Freedom Hosting cleared more than 40 CSAM sites at once, including Lolita City's reported 100GB of material1. By October 24, the BBC and Information Week had run their own coverage, with the BBC quoting NetClean's Christian Sjoberg warning that the DDoS approach could scupper live police investigations27.

On October 27, Anonymous ran a 24-hour phase called 'Operation Paw Printing' that swapped a modified TorButton onto the Hard Candy wiki, logging 190 unique visitor IPs before ending the DDoS phase5. The final #OpDarknet PasteBin communique posted on November 2, 2011, and the group announced the campaign would close on November 5, Guy Fawkes Day, 'sailing away for another Lulz'5. The playbook returned on February 3, 2017, when an Anonymous-affiliated hacker breached Freedom Hosting II, wiped its database, and left a 'you have been hacked' message on roughly 10,613 defaced hidden-service sites3.

Timeline

2011-10-14

Anonymous issues a 9 p.m. CST ultimatum to Freedom Hosting; when refused, the group DDoSes the host offline with 1GB SQL payloads and ASCII Guy Fawkes floods every five minutes.

2011-10-15

Freedom Hosting restores service via backup boxes; Anonymous re-attacks with the 'Chris Hanson' sub-operation, uploading To Catch a Predator clips onto the host.

2011-10-17

The YouTube channel BecomeAnonymous uploads the operation's manifesto video explaining goals and future plans.

2011-10-18

Anonymous leaks 1,589 Lolita City usernames to PasteBin and calls on Interpol and the FBI to investigate.

2011-10-22

Coverage escalates: the Huffington Post publishes a rundown after the Examiner and Gawker stories, and the operation trends on Reddit.

2011-10-24

The BBC, Wall Street Journal, and Information Week publish coverage, quoting researchers who worry the attacks may compromise ongoing police work.

2011-10-27

'Operation Paw Printing' logs 190 unique IPs via a modified TorButton pushed through the Hard Candy wiki.

2011-11-02

Final #OpDarknet PasteBin communique posted, revealing 'The Honey Pawt' modified TorButton.

2011-11-05

Planned end of Operation Darknet on Guy Fawkes Day, described in the last communique as 'sailing away for another Lulz'.

2017-02-03

An Anonymous-affiliated hacker breaches Freedom Hosting II, wipes its database, and defaces roughly 10,613 hidden-service sites, reviving the Operation Darknet playbook.

Cultural Impact

Coverage moved beyond tech blogs quickly. By October 24, 2011, the Wall Street Journal, Information Week, and the BBC had all run stories on the takedown27. Techie Buzz published an IRC interview with a hacker using the handle 'arson,' who told the outlet the mission focused only on illegal material and was not triggered by any single event5. The operation drew a rare positive note from commentators who had criticized Anonymous over earlier actions, with the Huffington Post writing that this target was 'unlikely to bring Anonymous much scorn'4.

The Mary Sue framed the takedown as one of the strongest applications of the group's skill set while cautioning that pulling material offline did not reach the predators who produced it6. Security researchers quoted by the BBC warned the DDoS approach could scupper live police work and taint evidence trails2. Six years later, Sarah Jamie Lewis told The Verge that the follow-up 2017 Freedom Hosting II wipe knocked out 'personal or political blogs and forums' alongside abuse sites, showing how much of the Tor ecosystem still sat on a single host3.

Fun Facts

The 'Chris Hanson' sub-attack uploaded episodes of To Catch a Predator labeled as CP files onto Freedom Hosting's servers, referencing the show's host Chris Hansen5.

The DDoS payload dropped a 1GB SQL file and 100,000 ASCII Guy Fawkes masks onto Freedom Hosting every five minutes during the October 14 takedown5.

Operation Darknet was scheduled to end on November 5, 2011, Guy Fawkes Day, with the closing PasteBin note describing the group as 'sailing away for another Lulz'5.

Ars Technica reported that Anonymous initially only managed to keep Freedom Hosting offline for about 30 hours despite repeated attacks7.

The 2017 Freedom Hosting II hacker later told VICE Motherboard that the FHII breach was their 'first hack ever,' according to reporting summarised on Know Your Meme5.

Derivatives & Variations

Operation Paw Printing: a 24-hour honeypot phase on October 27, 2011, that logged 190 unique IPs through a modified TorButton pushed via the Hard Candy wiki[5].

'The Honey Pawt': a modified Firefox TorButton, revealed in the November 2, 2011 PasteBin post, that recorded user information for anyone who tried to access Hard Candy or Lolita City with it installed[5].

Freedom Hosting II breach (February 3, 2017): an Anonymous-affiliated hacker used a similar playbook to wipe FHII and deface roughly 10,613 hidden-service sites, offering to sell the data back for 0.1 bitcoin[3].

Frequently Asked Questions