Stealthnet decloaked

The following pages provide information about IP addresses, search queries and shared content of RShare/Stealthnet users.

Our Research Respects User Privacy

The actual IP addresses have been masked so that such a connection between RShareIds and actual users or IP addresses is no longer possible. The data acquired during our brief research period was used only to make our calculations and was deleted immediately after these pages were generated. None of the original data has been retained, so it should no longer be possible to use our experimental results to expose which specific IP addresses were sharing or downloading content.

The Technique is Publically Documented

Although we did not retain sufficient information to identify individual users, the attack that was implemented does provide the complete IP address. Our approach is documented in detail in the September issue of c't magazine (published in Germany). We believe that others could use this information to again expose users of the RShare/Stealthnet network. RShare and Stealthnet users (especially of older versions of the software) should be wary of the fact that they may not be (sufficiently) anonymous.


The listings of search queries and shared content have not been edited and may contain terms that some readers may find offensive.

Research team: (C) 2007 Colorado Research Institute for Security and Privacy