In fact, everything is in English, and the site picks up users everywhere in the world. People visit this market to buy stolen credit cards, personal data, remote desktop account credentials, and logs gathered from information-stealing malware. The following table shows which hacked account credentials were most popular on the Russian-language darknet markets in terms of individual brands.
Tor2door Market
The “darknet” (or dark web) is a decentralized, unindexed, unregulated part of the World Wide Web that is only accessible using certain browsers, such as the so-called “Onion Router,” or “Tor” for short. The dark web has become an immense centre of criminal activity, a fully working marketplace where buyers and sellers may buy banned goods and services without any fear of detection. The world of the darknet has always attracted the attention of the masses. The market is also known for its listings related to financial fraud, such as phishing tools and stolen credit card information.
Category Deep-dive: Ransomware Demands Reached An All-time High In 2024
You can even find things such as BIN checkers and PayPal cookie converters. Another reason the Russian Market is so popular is that it’s pretty inexpensive compared to other dark web marketplaces. Discover everything about what a darknet market is, top marketplaces, security threats on them, and learn how to protect your data online. For context, only 4 of the 15 markets we found to be selling stolen account details were Russian and one of those did not have any VPN credentials for sale at the time of our study. The high volume of listings for hacked credentials for Russian streaming services were limited to Russian markets, which explains the lower prices (60% less on average).
The evolving landscape of crypto crime in 2024 highlights a complex interplay between advancing security measures and increasingly adaptive illicit actors. While efforts to curb illegal activities have shown promising results, threat actors continue to innovate — exploiting vulnerabilities within decentralized finance, blockchain infrastructure, and emerging technologies. The reduction in the quality and user numbers of Western DNMs stands in contrast to the Russian-language ecosystem, where fierce competition and high profits are driving innovation. Immediately change your passwords, enable two-factor authentication, and notify your bank or credit card provider if the leaked information includes your financial data. You should also consider freezing your credit to prevent identity theft. The fallout for victims whose data is stolen and sold can be devastating.
How To Gain Safe Access To The Dark Web Marketplaces
A Russian court sentenced a crime boss described by state media as the founder of dismantled darknet drug marketplace Hydra to life in prison on organized crime and drug charges. This market specialized in selling marijuana related products and magic mushrooms, with no “hard drugs” for sale. Given the explosive growth of these markets, organizations must prioritize proactive threat monitoring. Axis Intelligence provides dark web surveillance solutions that help businesses identify leaked credentials, fraud attempts, and malware risks before they escalate.
Did The Silk Road Marketplace Go Under?
Despite Telegram’s anonymity, the dark web is still a hot spot for illegal trading of malware, illicit goods, and stolen data (such as stolen credit card information). Even with the increase in law enforcement pressure, the dark web market still achieved a revenue of $2 billion in 2024. Therefore, as long as this dark part of the internet exists, these marketplaces will flourish and emerge. On the Russian darknet markets, VPN account log-ins were the most popular stolen credentials for sale, accounting for almost 40% of all listings. Indeed, Russian sites played host to an outsize proportion of hacked VPN account details, with 43% of VPN credentials globally from three of 15 darknet markets.
Category Deep-dive: Illicit Drug Sales Grew And Expanded Outside Of Darknet Marketplaces In 2024
It became the blueprint for other dark web marketplaces that tried to take its place. While this may all sound sophisticated, it is a financial crime and very risky. Those who use these services can still be traced and prosecuted if caught, especially as law enforcement continues to sharpen its tracking tools. BidenCash was launched in 2022, and since it became a hot spot for cybercriminals to sell and buy illegal things, including stolen card information and personal data. However, in June 2025, BidenCash’s relevant domains (around 145) were seized by the US Department of Justice. Next up is Abacus, another newer market that has already made a massive name for itself, especially following AlphaBay’s closure.
- While it might be tempting, remember that downloading such content has serious legal and cybersecurity risks.
- It brings in vendor reviews from other places and verifies them using PGP signatures, so buyers can feel a bit more confident about who they’re dealing with.
- We also pulled out the 20 individual brands that appeared most frequently.
- Historically, Telegram has been a favored platform for selling drugs — due to its security and public perception of non-cooperation with law enforcement, as well as strict access controls for groups and channels.
AI In Cybercrime: How Attackers Already Use It
NordVPN accounts were particularly prevalent in the Russian darknet markets, where we found over half the listings for stolen NordVPN credentials included in this study. In fact, NordVPN log-in details accounted for 48% of all the VPN accounts for sale on the Russian darknet markets. None of the darknet markets we looked at in our previous report still operate in 2023. While AlphaBay, a formerly major site that was shut down in 2017,2 has been resurrected, there are now 14 other completely new darknet markets where hacked account details are bought and sold.
OMG! OMG!
Wayaway topics have thousands of views and hundreds of comments indicating the forum serves as a high-volume resource for the Russian Tor community. Many of the most active users on Wayaway also trade in other drug and illegal goods forums on Tor. Police crackdowns, as is the case for traditional drug markets, are not effective measures to lower the volume of sales on online illicit drug markets. Cryptomarket participants have been shown to have a minimal reaction, or one that is temporary, to overtly large shows of force and to have the ability to adapt through displacement techniques. Cybercriminals on the dark web marketplace always look for new victims to target them with scams or infect their devices with malware, spyware, or adware.
Online Flea Market Bans Ultrasound Pics After Spike In Pregnancy Scams
These attacks usually involve DDOSing (overloading) the service and demanding a crypto payment from the site admins to stop the attack. The platform facilitated the sale of illegal drugs, stolen credit card data, counterfeit currency, and fake identity documents. Classic darknet markets sell diverse illegal goods; data stores focus on leaked or stolen data like credentials, databases, and ID records. WeTheNorth is a Canadian market established in 2021 that also serves international users. It offers counterfeit documents, financial fraud tools, hacking and malware services.
Despite using a VPN, there’s always a risk of the VPN leaking your IP address through DNS or WebRTC leaks or misconfigurations when on a dark web forum or marketplace. Therefore, you must run an IP leak test to ensure that the VPN is working completely fine and is not risking your digital security. Besides this, it supports wallet-less transactions and accepts payments through Bitcoins, Litecoin, Monero, and Zcash. However, you must wait some time to reassess this marketplace because it’s been shut down. It issued a press release revealing that, from December 2021, the website won’t be functional anymore.
The market claims to provide secure and anonymous commerce services. You can find a lot of goods and services packed with stealth high-level encryption, no JavaScript, and anti-DDoS protection. Another key difference was the popularity of ISP account details on Russian darknet markets compared to elsewhere. Not only were these credentials found for sale more commonly but they were worth significantly more with an average price of $408 compared with $15 on non-Russian darknet markets. More than one in five of the darknet market listings for hacked accounts that we found was for a VPN service. If we were to exclude data from Russian markets then PayPal would be tied with NordVPN as the most popular brand.
