Dark web markets boom after AlphaBay and Hansa busts

Image copyright
Cyberint

Trade on several of the dark web’s illegal markets has boomed since two major players were shut by the authorities last month, according to research carried out for the BBC.

The US and Dutch authorities forced AlphaBay and Hansa offline to prevent the sale of drugs, weapons and malware.

But over the last week of July, other sites saw their number of listings rise by as much as 28%, the study indicates.

Sales of some goods do, however, appear to have been reduced.

“There is growing evidence that when one illegal dark web marketplace is closed, the illicit business quickly starts to be redirected to other sites which are still active,” commented Elad Ben-Meir, marketing chief at the Israeli cyber-security firm Cyberint, which carried out the research.

“However, there is also evidence that continuing crackdowns by international law enforcement operations, are having the effect of forcing illicit traders away from those sites selling firearms or child pornography.”

Media playback is unsupported on your device

The markets are given the “dark web” moniker because they cannot be accessed via a normal internet browser, and their listings are hidden from mainstream search engines.

‘Fear and uncertainty’

The closure of AlphaBay and Hansa was revealed on 20 July.

Cyberint looked at what change in activity there had been on five other leading dark web markets between 24 July and 31 July.

According to its numbers, Dream Market is now the biggest illegal store with a total of 98,844 listings at the end of the month.

The site was launched in late 2013 and is now one of the oldest dark web markets in existence.

Its number of listings rose by 3,818 over the course of the week.

While that was the biggest increase of the surveyed sites in numerical terms, it represented a relatively modest increase of 3.9%.

“There is some interesting buzz around Dream Market potentially being compromised and/or under law enforcement control, which is feeding fear and uncertainty amongst vendors and buyers,” said Mr Ben-Meir.

“That is probably why Dream Market has not grown substantially in the wake of the takedowns.”

Europol and the FBI have promised “hundreds” of follow-up investigations off the back of their initial takedowns.

Dream Market vendors are aware that Hansa was seized and covertly monitored for about a month after AlphaBay was deactivated.

That has led to unverified speculation on several online forums that Dream Market’s servers have also been hijacked.

‘Touting for business’

The next biggest site is TradeRoute, which rose from 14,914 listings to 17,816 over the period – a 16.3% gain.

It includes forged documents and black market tobacco and alcohol among its wares.

“TradeRoute is actively touting for new business with threads welcoming vendors displaced from AlphaBay,” said Cyberint’s report.

Image copyright
Cyberint

In percentage terms, Tochka can claim the biggest boost. Its listings rose by 28.1% to 2,390.

The site specialises in illegal and prescription drugs among other products.

Wall Street Market, a relatively new platform with a more polished design than is the norm for such sites, experienced a similar lift.

Its number of listings grew by 25.4% over the week to 2,216.

Gun market

Of the markets covered, only one experienced a drop-off in activity.

RsClub Market is the only one of the five sites to sell guns – its only restriction on weapons listings is that they must not offer “weapons of mass destruction”.

The site’s listing count dropped by 638 to 1,689 over the week – a 37.8% fall-off.

Image copyright
Cyberint

Cyberint suggested that this might be linked to the fact the Rand Corporation think tank and the University of Manchester had jointly published a report into the size and scope of the dark web’s illegal arms trade on 19 July. It said that 60% of the weapons put on sale had been sourced from the US, and that terrorists were among suspected buyers.

Cyberint believes those looking to buy and sell other illegal goods might now be steering clear of RsClub Market because it was likely to be a focus of follow-up investigations.

One adviser to Europol said the findings were of interest but only told half the story.

“The takedowns have certainly not discouraged the vendors but it’s still not totally clear if it has put off the buyers,” said Alan Woodward.

“The sellers believe they are relatively immune – they don’t use their real details so are hard to track down even if a site is commandeered – but the users have to give delivery addresses and the like.

“That’s why the emphasis is on taking the markets down and that’s exactly what law enforcement wants to do.”