James Mason argues that the landscape of Darknet markets and forums may be ever-changing, but in one form or another they are also ever-present.
Ever since the closure of the AlphaBay and Hansa markets back in July 2017, there has been a sense that Darknet vendors are holding back in fear of law enforcement. This is a widespread and continuous sentiment which has plagued the Darknet markets and forums for nearly an entire year.
AlphaBay and Hansa were closed down following Operation Bayonet, a joint initiative between Dutch police forces and the FBI. It is believed that as many as 10,000 real-life identities of Darknet users may have been exposed during the operation. Given the legal proceedings involved, it is only now that former vendors in these Darknet markets are being sentenced. As the headlines of lengthy sentences hit the press, the shockwaves from Operation Bayonet continue to reverberate throughout the Darknet community.
Several forums have even set up dedicated ‘news’ channels to keep track of the various arrests and sentences which are slowly yet steadily filtering through into mainstream news sources. At face value, these channels are designed to keep buyers up to date of which vendors are still available for trade, and which accounts may have been compromised by law enforcement. Though functional, these channels are perhaps further adding to the sense of fear and mistrust that is rampant across the Darknet.
That said, the Darknet community doesn’t show any sign of disappearing. There may have been a large number of arrests, and there may be a large number of users who have reduced their activity in fear of retribution, but the community is alive and well, and certainly isn’t going to give up that easily.
As has been an ongoing theme over the past 12 months, there’s been yet further movement among the markets and forums. Some new sites have emerged, some former sites have vanished. As ever, buyers and vendors alike are kept in a permanent state of disarray, despair, and total frustration. Here are a few of today’s most popular and active Darknet markets:
Wall St Market
Wall St Market emerged out of the chaos of 2017, and whereas its counterparts such as TradeRoute, Outlaw, Aero, and Agora Reloaded all fell, it has stood the test of time and is now regarded as a stable, trustworthy, and longstanding site by the majority of its users. Both the forum and marketplace areas of Wall St see a lot of activity: the market currently boasts 468,000 users, of which 3,174 are vendors. These figures have both increased significantly from April when the site had 390,600 users, and 2,893 vendors. Though a longstanding market, Wall St is continuing to expand dramatically showing how users consider this to be a credible platform for trade. Listings cover a wide range of products, mostly focusing on fraud, cybercrime-as-a-service offers, and drugs.
Empire Market
Empire Market is a new and promising market. Most notably, it uses the source code from AlphaBay. This appears to have had an extremely positive effect on users, who are repeatedly praising the site’s user interface. There are 1,029 members currently signed up on the Empire forum, and 3,671 listings in the marketplace. This has expanded from just 238 members and 2,993 listings at the start of April. Growth has been fairly slow to get started, but the market appears to be picking up momentum. As unlikely as it may be, it feels as though the source code of AlphaBay has returned some of the spirit of AlphaBay: listings are starting to go up more rapidly and are covering all areas of cybercrime, from malware to drugs, fraud, weapons and counterfeits.
Olympus Market
Olympus is another new market which emerged in early 2018 and has shown significant growth so far. There are currently 25,706 listings on offer on the marketplace, and 3,589 registered members on the forum. The Olympus administrators were recently involved with an attack on rival platform Dread (see below), and went offline for several weeks after apologising to the Darknet community. The dispute now appears to have been resolved however, and a revamped version of Olympus Market has come back online and is even busier than before.
Dread
Dread is in fact neither a market nor a forum, but more of a platform set up in the style of Reddit. Dread came to prominence in early 2018 when several of the Darknet market-related channels were banned from Reddit and users sought out a new area to discuss the different markets and forums.
Dread grew extremely rapidly, with more than 12,000 users registering accounts within three months of it being launched. Dread suffered a few weeks of downtime after being hacked by Olympus Market administrators who at the time claimed that @HugBunter, the administrator behind Dread, was a scammer. The two sites have now settled their differences however, and Dread is continuing to expand with a total of 14,683 registered members at last count. Less focused on trade, Dread serves as more of an information hub where users can discuss fraud methods, and review vendors and markets.
Dream Market
Against all odds, Dream Market still exists. Active since 2013, this is one of the oldest markets. Many Darknet users believe it has been compromised by law enforcement, but there does not seem to be any conclusive evidence surrounding these claims. There are currently 17,943 users registered on the Dream Market forum; while there is still a large number of active accounts, much of the activity appears to be limited to scammers or the sale of drugs. General chatter indicates a widespread mistrust of this market, and declining popularity.
Tochka
Tochka is another market that has been around for a while, yet continues to soldier on. It suffered heavy downtime towards the end of 2017 when all the major Darknet marketplaces were under prolonged DDoS attacks. However, despite this, Tochka has managed to stage a comeback and has even rebranded itself as Point Marketplace to cater for its English-speaking customers. The market has a quiet forum attached to it with few active members, but a wide variety of marketplace listings including drugs, weapons and counterfeit goods.
Club2CRD
A mix of Russian and English, Club2CRD spans a pretty extensive range of offers from malware and exploits to POS devices and hacked accounts. The site is a forum, as opposed to a marketplace, but trade is actively encouraged. There are currently 78,827 registered accounts on Club2CRD, and there have been more than 159,000 comments posted on the site in total.
Joker’s Stash
Joker’s Stash is one of the most notorious credit card dump sites. The store doesn’t actually specify how many credit card records are for sale on the site, but the exposure for some banks is vast. Some banks’ card exposure on Joker’s Stash is known to run well into the high thousands, so the total number of cards on the site could well be in the millions. Records vary in price depending on the bank, and also the quality and quantity of data contained within each data set. Prices generally range from anything between $1 or $2 (~€0.86 or ~€1.73) to as much as $400 or $500. New breaches are regularly added to the site, and regular customers are usually given exclusive access to purchase fresh records before they go on public sale for the rest of the site.
So what does it all mean? One of the main themes running throughout all of these Darknet markets is that there is an enormous number of people using them. Add to this the fact that these are just a handful out of many more markets that exist alongside them.
There may well be external forces – such as law enforcement intervention – which influence activity levels in the short term. The current price of Bitcoin, too, which has plunged from nearly $10,000 in mid-May down to $6,700 in mid-June, could also be a factor in the short-term which might curb transactions made using the cryptocurrency.
The bottom line however, is that there is a vast community of nefarious actors using Darknet markets which isn’t going away anytime soon. The platforms that this community uses will inevitably change. Indeed several users have moved away from the Darknet altogether: Telegram and ICQ are two popular encrypted chat platforms which are gaining popularity and replacing a considerable amount of forum interaction. However, while the means and channels of communication may vary considerably, the actors and their intentions remain fairly constant. The landscape of Darknet markets and forums may be ever-changing, but in one form or another they are also ever-present.
James Mason
Darkweb Intelligence Analyst
Cyjax Limited
London
+44 (0)20 7096 0668
info@cyjax.com
www.cyjax.com
