Dark Web Marketplaces: Intelligence for Cybersecurity and Law Enforcement

Dark web marketplaces are anonymous online trading platforms where individuals and criminal organizations buy and sell illicit goods, services and information.

In many ways, these marketplaces resemble legitimate e-commerce platforms. They can have search functions, product categories, vendor profiles, customer reviews, advertising, reputation systems and mechanisms for handling transactions. The difference is in what is being bought and sold.

Dark web marketplaces have historically been associated with the sale of drugs, counterfeit goods, weapons and forged documents. They have also become an important part of the cybercriminal economy, with marketplaces and specialized autoshops offering stolen credentials, payment card information, malware, hacking tools, infostealer data and compromised access.

For cybersecurity teams, these marketplaces can provide a key source of dark web intelligence, providing visibility into stolen information and access being offered for sale. For law enforcement and criminal investigators, they can provide intelligence about criminal activity, vendors, products, transactions, geography and relationships between actors.

The marketplace landscape is also highly dynamic. Major marketplaces can disappear following law enforcement action, technical disruption or an exit scam, while new markets emerge to attract displaced vendors and buyers. Understanding how these marketplaces operate is therefore an important part of investigating activity on the dark web.

‍

What Are Dark Web Marketplaces?

Dark web marketplaces are online platforms designed to facilitate transactions while providing a degree of anonymity to buyers, sellers and marketplace administrators.

Many marketplaces are surprisingly similar to legitimate e-commerce websites. A typical marketplace may include:

• A search function for finding products
• Categories for different types of goods and services
• Individual product listings
• Vendor profiles and reputation scores
• Customer reviews
• Featured or promoted listings
• Cryptocurrency payment systems
• Escrow services
• Dispute resolution mechanisms

The exact structure varies between marketplaces. Some specialize in particular types of products, while others operate as broad marketplaces containing hundreds or thousands of vendors.

Marketplaces can also operate on either the dark web or clear web, and some maintain infrastructure across both. The defining characteristic is therefore not simply where a marketplace can be accessed, but the anonymous or restricted environment in which it facilitates criminal commerce.

What Is Sold on Dark Web Marketplaces?

The products sold on dark web marketplaces span a wide range of criminal activity.

Traditional dark web marketplaces have been heavily associated with drugs, but marketplaces can also facilitate the sale of counterfeit goods, forged documents, stolen financial information and other illicit products.

For cybersecurity professionals and investigators, digital goods are particularly significant. These can include:

• Stolen credentials
• Payment card information
• Personal and financial data
• Infostealer logs
• Cookies and session information
• Compromised accounts
• Remote access
• Malware
• Hacking tools
• Exploits
• Cracked software

The distinction between physical and digital goods is important because digital products can be sold repeatedly. A physical product generally disappears from a vendor's inventory after it is purchased, whereas the same digital information or software can potentially be sold to multiple buyers.

This makes it difficult to determine the true volume of transactions taking place on some marketplaces simply by looking at the number of listings.

How Do Dark Web Marketplaces Work?

Most dark web marketplaces operate by bringing together marketplace administrators, vendors and buyers.

The administrators provide the platform and build the systems needed to manage listings, users and transactions. Vendors then use the platform to advertise individual products or services, while buyers search for and purchase what they need.

On an escrow marketplace, the buyer typically sends cryptocurrency to an intermediary wallet controlled by the marketplace rather than directly to the vendor. The marketplace holds the funds until the transaction is completed, after which the money is released to the vendor.

This system provides a mechanism for establishing trust between anonymous buyers and sellers who otherwise have little reason to believe that the other party will fulfil their side of the transaction.

Other marketplaces, particularly autoshops, use automated transactions because the products being sold can be delivered digitally and immediately.

Escrow Marketplaces vs. Autoshops

There are two broad types of dark web marketplace that are particularly relevant to cybersecurity professionals and investigators: escrow marketplaces and autoshops.

Escrow Marketplaces

Escrow marketplaces are multi-vendor platforms where vendors can establish their own storefronts and sell products to buyers.

They are broadly comparable to legitimate marketplaces such as Amazon or eBay. The marketplace operator provides the infrastructure and transaction system, while individual vendors are responsible for listing and selling their products.

Vendors typically need to meet the marketplace's requirements before they can begin selling. This may include paying a vendor bond.

Transactions generally use cryptocurrency and may be protected by an escrow system. The buyer's funds are held by the marketplace until the transaction is completed, reducing the risk of a vendor taking payment without delivering the product.

Escrow marketplaces can specialize in particular types of goods, including drugs, counterfeit goods, forged documents or digital products such as malware and hacking tools. Others operate as broad marketplaces covering many different categories.

Autoshop Marketplaces

Autoshops are a specialized form of dark web marketplace focused primarily on digital products.

Because the products can be delivered electronically, there is generally no need for the marketplace to hold funds until physical delivery has been confirmed. A buyer can select a product, make a payment and receive the product automatically.

Autoshops commonly sell:

• Payment card data
• Banking information
• Account credentials
• Cookies and session information
• Infostealer logs
• Malware
• Hacking tools
• Other stolen digital information

Autoshops also differ from escrow marketplaces in their vendor structure. They generally have fewer vendors, and products may sometimes appear to be sold directly by the marketplace rather than by identifiable individual sellers.

This can make the relationship between the marketplace operator and the underlying source of the data less transparent. It may also suggest a more selective process for determining which sellers are allowed to supply products.

For investigators, this difference is important because the marketplace itself may be a more significant entity of interest than an individual vendor.

How Do Dark Web Marketplaces Build Trust?

Anonymity creates an obvious problem for dark web marketplaces: buyers need some reason to trust sellers, and sellers need some reason to trust buyers and the marketplace operator.

Marketplaces have developed a range of mechanisms to address this.

Escrow is one of the most important. By holding payment until a transaction is completed, the marketplace can reduce the risk of a buyer paying a vendor who never delivers.

Reputation systems are another important mechanism. Vendors may accumulate ratings and reviews based on previous transactions, with buyers assessing factors such as product quality, delivery and reliability.

Dark web forums also play an important role in establishing reputation. Buyers may discuss vendors, recommend particular sellers or warn other users about scams. In this respect, forums can act as an informal layer of regulation around marketplace activity.

This reputation system can provide useful intelligence for investigators. Vendor names, reviews, complaints and discussions across different platforms can help establish relationships between individuals and criminal communities.

How Big Are Dark Web Marketplaces?

Determining the size or popularity of a dark web marketplace is more difficult than it might appear.

The number of listings is one useful indicator, but it does not necessarily represent the number of transactions taking place. Listings may be duplicated, deliberately spammed or unreliable.

The number of active vendors provides another useful measure. For escrow marketplaces in particular, a large active vendor base can indicate that criminals consider the marketplace worthwhile as a place to sell their products.

Looking at listing volume and active vendors together therefore provides a more useful indication of marketplace scale than either metric alone.

There is much less visibility into the number of buyers. Buyers generally remain more anonymous, and the information available about them may be limited to activity such as reviews.

The same limitation applies to transaction volumes. A single digital product can potentially be sold repeatedly, meaning that the number of listings does not necessarily correspond to the number of individual transactions.

For investigators, this means that marketplace activity should be assessed using multiple indicators rather than relying on a single measure of popularity.

What Can Dark Web Marketplaces Reveal to Investigators?

Dark web marketplaces can provide investigators with intelligence about a wide range of criminal activity.

Marketplace listings can reveal:

• What types of illicit goods and services are being traded
• Which vendors are active
• How vendors describe their products
• Which markets specialize in particular criminal activity
• How vendors build reputations
• Where products are being sold or shipped
• How criminal communities interact with one another
• How marketplaces and vendors change over time

The information can also extend beyond the marketplace itself. Vendors may use the same aliases on forums or other dark web services, while marketplace activity can provide leads that investigators can follow across different sources.

This makes marketplace monitoring particularly valuable as part of a wider investigation rather than as an isolated source of information.

Can Dark Web Marketplaces Be Geolocated?

Understanding where a marketplace or its users are located can be particularly valuable to investigators, but geography on the dark web is rarely straightforward.

The language used by a marketplace can provide an initial indication. For example, a predominantly Russian-language marketplace may be oriented towards Russian-speaking countries, while an English-language marketplace may target a broader international audience.

However, language alone cannot reliably establish where a marketplace operates. English may be used simply because it provides access to a larger international audience.

Vendor-level information can provide more specific clues. Vendors may state where they are based, where they are willing to ship or which countries they will not serve.

Some of this information is structured, while other geographic clues appear only in the free-text descriptions of individual listings. Extracting this information at scale can therefore be challenging.

For law enforcement agencies operating within specific jurisdictions, understanding these geographic connections can be particularly important. A marketplace may involve administrators, vendors, infrastructure and customers located across multiple countries, creating an inherently international investigation.

Why Are Dark Web Marketplaces Difficult to Investigate?

The anonymity provided by the dark web creates significant challenges for investigators.

A marketplace may involve several different layers of infrastructure and participants:

• Administrators may be located in one country
• Servers may be hosted in another
• Traffic may pass through infrastructure in other jurisdictions
• Vendors may operate from multiple countries
• Buyers may be distributed internationally
• Products may be shipped across multiple borders

This makes it difficult to attribute a marketplace to a single location or jurisdiction.

Tor's architecture is specifically designed to make identifying users and infrastructure difficult. As a result, investigations into major marketplaces can require significant technical expertise and international cooperation.

Despite these challenges, law enforcement agencies have successfully disrupted major marketplaces. Such operations often involve cooperation between agencies in multiple countries because the people, infrastructure and activity associated with a marketplace may cross national boundaries.

Why Do Dark Web Marketplaces Disappear?

Dark web marketplaces typically have much shorter lifespans than legitimate online marketplaces.

One reason is law enforcement intervention. Marketplaces may be seized or disrupted when investigators identify their infrastructure or administrators.

Technical problems, attacks by other criminals and disputes between administrators can also cause marketplaces to disappear.

Another major risk is the exit scam.

In an exit scam, marketplace administrators effectively steal the funds held by users before shutting down the platform. A marketplace may stop processing withdrawals while continuing to accept deposits, leaving vendors and buyers unable to recover their cryptocurrency.

Administrators may initially claim that the problem is temporary, while users debate what is happening on forums. Eventually, the marketplace disappears and the operators leave with the accumulated funds.

This volatility means that a marketplace that appears significant today may no longer exist a few months later.

For investigators and intelligence teams, tracking the marketplace ecosystem therefore requires continuous monitoring rather than periodic assessment.

Why Do Dark Web Marketplaces Matter to Cybersecurity?

Dark web marketplaces can provide an early warning of information and access that could be used against an organization.

Cybersecurity teams may discover:

• Employee credentials being offered for sale
• Corporate accounts appearing in stolen data
• Payment or personal information associated with customers
• Infostealer logs containing corporate credentials
• Cookies or session information that could enable account compromise
• Remote access to corporate systems
• Data stolen during a previous breach

This activity can be particularly important because compromised information may form part of a wider criminal supply chain.

For example, credentials stolen through malware may be packaged into logs, sold through an autoshop and subsequently purchased by another criminal who uses them to gain access to an organization.

Monitoring marketplaces can therefore help security teams identify compromised information before it is used in a subsequent attack.

Dark Web Marketplaces Are Part of a Wider Criminal Ecosystem

Marketplaces do not operate in isolation. A criminal operation may involve multiple platforms and services, with different parts of the ecosystem performing different functions.

A credential could be stolen by an infostealer, sold through an autoshop, discussed on a hacking forum and subsequently used to access an organization.

Similarly, an Initial Access Broker may acquire access to a corporate network and advertise it to other criminals, who then purchase that access to conduct ransomware, fraud or data theft.

Forums can provide information about vendors and reputation. Marketplaces can reveal products and transactions. Autoshops can expose large volumes of stolen digital information. Ransomware leak sites can provide evidence of victims and stolen data.

Connecting these sources can provide a much more complete picture of criminal activity than monitoring any one platform in isolation.

Why Monitor Dark Web Marketplaces?

For cybersecurity teams, marketplace monitoring can help identify compromised information and access before it develops into an incident.

For law enforcement and investigators, marketplace intelligence can help identify criminal activity, understand vendors and marketplaces, establish geographic connections and develop leads across the wider criminal ecosystem.

Effective monitoring can help organizations and investigators:

• Discover new marketplaces and emerging criminal services
• Identify vendors and their activity
• Understand what types of products are being traded
• Track changes in marketplace activity
• Identify compromised credentials and stolen information
• Investigate geographic connections
• Connect marketplace identities with activity elsewhere
• Monitor marketplaces before and after significant events
• Identify when marketplaces disappear or are replaced
• Build a broader intelligence picture around criminal activity

The key is not simply finding a marketplace. It is being able to continuously monitor the activity taking place within it and connect that intelligence with other sources.

The Dark Web Marketplaces to Watch

The dark web marketplace landscape changes constantly. Established marketplaces can disappear following law enforcement action, technical disruption, internal disputes or exit scams, while new platforms can quickly emerge to attract displaced vendors and buyers.

The marketplaces below represent some of the most significant sources of intelligence for cybersecurity professionals and investigators. They are divided into two broad categories: escrow marketplaces, which operate as multi-vendor platforms, and autoshops, which specialize in the automated sale of digital products.

Escrow Marketplaces

‍

Abacus  [OFFLINE]

‍

Active Since: September 2021

‍

Abacus set up shop in 2021 and quickly grew to become one of the most popular Western darknet markets, particularly with Australian vendors and buyers.

Users began to experience difficulties accessing Abacus in June 2025, with it being deemed an exit scam a month later when the site had not returned and over $200,000 worth of cryptocurrency had been transferred out of the market’s hot wallet.

‍

Archetyp [offline]

‍

Active Since: May 2020

Dark Web

Predominant Languages: English, German

Known Aliases of Admins or Staff: BigBossChefOfArchetyp

‍

The majority of listings on Archetyp were for drugs (with the biggest categories being cannabis and stimulants) with a very small number of other products, such as SIM cards.

Somewhat unusually for the “mainstream” dark web markets, Archetyp allowed the sale of fentanyl and analogous substances.

Many markets prohibit fentanyl listings, along with products and services such as weapons, poison, CSAM, and hit-man-for-hire in an attempt to avoid the attention of law enforcement.

Update June 2025: Archetyp was seized in June 2025 in an international law enforcement operation, leading to the arrest of its administrator and the seizure of assets worth EUR 7.8 million. Up until the takedown, it was the biggest and longest-running western dark web market, operating for over five years.

‍

ASAP [offline]

‍

Active Since: March 2021

Dark Web

Predominant Languages: English, French

Known Aliases of Admins or Staff: Aseanmarket, AStrike, LeChacal, Kreed

‍

ASAP was originally launched in March 2020 as ASEAN, before rebranding in October 2020.

In July 2023, after an impressive three year run, ASAP’s administrator announced on the dark web forum Dread that the marketplace was retiring and urged users to withdraw their coins. As ASAP was the biggest market by listing volume and fourth biggest by number of vendors, it left a big gap to fill.

The types of advertisements we observed on ASAP included drugs (predominantly stimulants and cannabis), fraud resources, and credit card details. Some vendors also sold cybercriminal goods and services including stolen login credentials, hacking tutorials, and “hackers for hire”.

‍

BlackOps

‍

Active Since: September 2022

‍

BlackOps is a fairly new dark web market, beginning activity in September 2024. It quickly gained popularity, perhaps owing to unique features such as a variable vendor fee based on number of sales and the option to add market users as employees. Its product offerings are fairly standard, though one quirk is that the number of digital products for sale exceeds its drug-related listings.

‍

Bohemia [offline]

‍

Active Since: May 2021

Dark Web

Predominant Languages: English, German

Known Aliases of Admins or Staff: Bohemia, BohemiaDionysus, BohemiaAres, BohemiaIkdev, BohemiaNorth

‍

Bohemia was primarily a drugs market skewing heavily towards cannabis.

The site also had a sister market dedicated solely to cannabis products. However, its listings also included counterfeit items such as identification cards and banknote forgeries, as well as a small number of advertisements for exploits and malware.

With the recent closure of major marketplaces including AlphaBay, ASAP, and Tor2Door, Bohemia took pole position as the one of the most popular dark web markets and attracted an influx of new users. However, very quickly cracks began to show, with notable disruption taking place on the site from early October 2023. At one point the market was inaccessible and its users and vendors started to complain that they could not access their funds and were receiving patchy communication from the site’s administrators.

In November 2023 one of the Bohemia administrators posted on the dark web forum Dread to explain this disruption, claiming it was due to the actions of a rogue developer. Many former market users and vendors remained suspicious and wary of returning to the market. Their scepticism proved prudent, as Bohemia once again went offline.

In October 2024, the alleged administrators of the Bohemia (and its sister site Cannabia) were arrested after reportedly shutting down their dark web sites and attempting to escape with their profits. The arrests follow an investigation launched in 2022, during which Dutch Police traced servers associated with the marketplaces in the Netherlands.

‍

Cypher [offline]

‍

Active Since: February 2020

Dark Web

Predominant Languages: English, German

Known Aliases of Admins or Staff: Cypher, Rootless, codeless

‍

Until it went offline, cypher was one of the longest-running dark web markets.

Originally launching in February 2020, Cypher stood out for having a long “uptime”. That all changed in 2024, when the site went offline

While it was active, its primary drug listings were for stimulants and cannabis. A large number of guides and tutorials on fraud, hacking and carding, and miscellaneous digital products were sold on the site.

‍

Darkmatter

‍

Active Since: September 2022

Dark Web

Predominant Language: English

Known Aliases of Admins or Staff: quasar1, BlackMask, zamman

‍

While it’s considerably smaller in size than other markets featured, DarkMatter has been consistently building a user base while avoiding the typical scandals that often plague its larger peers.

DarkMatter was launched in September 2022, and differentiates itself by only allowing Monero (rather than the older and less privacy-focused Bitcoin) transactions. It also offers a walletless payment system, meaning customer deposits aren’t stored on the site, in an attempt to assuage fears of exit scams. Predominantly hosting drug vendors, DarkMatter also offers a number of fraud, counterfeit, and malware products.

‍

DrugHub

‍

Active Since: August 2023

Predominant Language: English

‍

DrugHub’s creators claim to be former staff members of WhiteHouseMarket, an extremely popular dark web market which closed its doors (without exit-scamming) in October 2022.

Trading on this good reputation appears to be working, as DrugHub has become a frontrunner in both number of listings and number of active vendors in recent months. Key features include Monero-only transactions, mandated PGP login, and a multi-vendor shopping cart system.

DrugHub recently absorbed the userbase of another platform, SuperMarket, after one of SuperMarket’s admins was alleged to have absconded with its customers’ on-site cryptocurrency.

‍

Incognito [offline]

‍

Active Since: October 2020

Dark Web

Predominant Languages: English, German

Known Aliases of  Admins or Staff: IncognitoOfficial, CurlyDock, pharoah, Burian

‍

All of the listings on Incognito were drugs related, with no digital or fraud products.

One notable feature of Incognito was the option to use semantic search (matches meaning of search term(s) accounting for user intent and search context, rather than exact matches and variants – known as lexical search).

Incognito also had a community governance section where users could make proposals related to the market and vote on them (e.g. adding a new feature) and the Incognito Foundation that users can donate funds to, which (it claimed) then get distributed to orgs such as Tor Project, Monero and Medecins Sans Frontieres.

In March 2024 it was reported that the administrators of Incognito Marketplace had perpetrated an exit scam with a particularly sinister twist. Speculation arose that the market was perpetrating an exit scam as early as March 6 when multiple users reported that they were unable to withdraw their cryptocurrency. Then on March 10 a message appeared on the site saying there was one “final little nasty surprise”. The message explicitly blackmailed the site’s vendors, threatening to publish cryptocurrency transaction and chat records of users who refuse to pay a fee ranging from $100 to $20,000.

However, this time the administrators of the forum didn’t manage to get away with the exit scam their perpetrated. In May 2024 the US Department of Justice announced that they had arrested pharoah, one of the market administrators whose real life identify was Rui-Siang Lin.

‍

Kerberos [offline]

‍

Active Since: September 2022

‍

Since its launch, Kerberos stayed fairly under the radar, perhaps owing to the fact that it did not maintain an official presence on Dread. Despite this, Kerberos was consistently active and maintained a substantial userbase of vendors and customers, predominantly trading in drugs and stolen logins.

March 2026 Update: Kerberos is believed to have exit-scammed in February 2026.

‍

MGM Grand [offline]

‍

Active Since: April 2021

Dark Web

Predominant Language: English

‍

MGM Grand was another long-standing market, setting up shop in 2021.

Its main category of products was Drugs, with sizeable sections for Fraud and Digital Goods. Despite flying under the radar, MGM Grand had a small but loyal userbase and suffered comparatively few controversies in its time on the dark web.

Update June 2025: MgmGrand shut down in June 2025, after warning users to withdraw funds kept on the market several months prior.

‍

Nemesis [offline]

‍

Active Since: May 2021

Dark Web

Predominant Languages: English, German

Known Aliases of Admins or Staff: FatherFrancis, Alita

‍

German authorities announced on March 21 2024 that they had taken down the Nemesis market.

The law enforcement takedown involved the seizure of the marketplace’s infrastructure in Germany and Lithuania and cryptocurrency worth the equivalent of approximately 102,000 USD. German authorities stated at the time of seizure that Nemesis had 150,000 user accounts and over 1,100 seller accounts worldwide.

Nemesis was rare among escrow markets for not having drugs as the top product category – though there were of course still plenty for sale.

Instead, the most common listing classifications were guides and tutorials and carding. Carding is dark web terminology for stealing or purchasing credit card details which can then be “cashed out” in a number of ways, such as by using them to buy high-value goods or prepaid cards that can then be used by the attacker or sold for profit.

Nemesis was also notable for the feud between itself and the operators of dark web forum Dread after its dedicated subforum was banned from the site. Never-the-less, it managed to maintain its popularity in spite of being seen as an “outsider” and viewed with suspicion among some dark web users.

‍

Tor2Door [offline]

‍

Active Since: July 2020

Dark Web

Predominant Languages: English, Spanish

Known Aliases of Admins or Staff: Needsadesigner, Geth, Sundec

‍

In September 2023 the Tor2Door site – at the time one of the biggest and longest standing marketplaces – closed.

Its administrators were unresponsive and, due to a lack of law enforcement announcement about a take down, it is widely believed that the operators have exit-scammed.

As well as being a market for drugs, Tor2Door was also an active market for fraud and cybercriminal activity. On the financial side, this included the sale of “fullz” (which is slang for the “full” packet of financial and personal data you would need to commit fraud against an individual), “high balance credit cards”, and even unbranded gold bars (which the vendor claimed to have 99 percent purity – but are probably a scam).

On the cybercrime side, we observed the sale of guides on hacking email accounts, bypassing 2FA, and the “Ultimate Botnet Guide” for sale for the Bitcoin equivalent of $5.

‍

Torzon

‍

Active Since: September 2022

‍

Torzon launched in September 2022. As of July 2025 it has resided on darknet forum Dread’s superlist, an almanac of dark web markets deemed trustworthy by the community of users. Its primary offerings are standard: drugs, fraud, counterfeits and digital products.

‍

We The North

‍

Active Since: July 2021

Predominant Languages: English and French

‍

We The North caters exclusively to Canadian vendors and buyers.

The market promotes its Canadian focus as increasing the reliability – and lowering the risk – of drug and physical purchases, due to the lack of border checks in the delivery process.

The site also hosts vendors offering digital products, including hacking guides, stolen credit card information, and malware.

Accessible in both English and French, We The North is viewed as the spiritual successor to previous Canada-only marketplace, CanadaHQ, and has been active since 2021 – a long time in dark web terms.

‍

Autoshop Marketplaces

‍

2easy [offline]

‍

Active Since: March 2020

Clear Web

‍

2Easy specialized in the sale of “logs”, which in this context refers to records harvested by information-stealing malware (also known as infostealers).

This is typically data that is stored in the web browser, such as site credentials, cookies, and autofill form data, which can be used to digitally impersonate an individual and steal from their accounts.

‍

B1ackStash

‍

Active Since: January 2024

Dark Web or Clear Web?: Both

‍

B1ackStash is a carding autoshop that opened in early 2024, but its admin was actively sharing large datasets on cybercrime forums 6 months earlier. Despite successful monetization, B1ackStash still promotes their store by regularly releasing batches of free data on predominantly Russian-speaking forums, including a recent drop of over 4 million stolen credit card details.

‍

Bahira

‍

Active Since: March 2022

Dark Web or Clear Web?: Both

‍

Fraudsters began recommending Bahira Finance on dark web forums in early 2022.

The name, which is shared by a Christian monk in Islamic theology, was likely selected due to its meaning of “tested” or “approved” in the Syriac language. Fittingly, Bahira offers numerous validity and balance checkers for the card details it sells, which is important to its customers who often bemoan the common experience of purchasing “dead” cards.

Bahira has generated buzz in both Russian and English-speaking dark web spaces and boasts the sale of both card details and dumps (the information encoded onto a card’s magnetic stripe and used to make physical clones). Unlike some autoshops, users can apply for vendor accounts on the site, rather than being part of a closed group or selling card databases behind the scenes.

‍

BidenCash [offline]

‍

Active Since: February 2022

Dark Web or Clear Web?: Both

‍

BidenCash specializes in payment card data, commonly differentiated in cybercrime circles as either CVVs (the data needed to make fraudulent e-commerce purchases), dumps (the raw magnetic strip data needed to manufacture fake or “cloned” cards), or fullz, sourced from a number of “bases” (databases).

BidenCash listings vary in level of completeness, with most including the card’s BIN, security code, expiry date, and type (e.g. Visa or Mastercard, credit or debit). Some also include associated PII such as the DOB, SSN, phone number, email and physical address of the victim. BidenCash has released several free bases on underground forums as promotional material.

In spite of the use of his name and image, it is highly unlikely to be associated with the president of the United States. In fact, it is probably a reference to Trump’s Dumps, a predecessor that used former President Donald Trump’s likeness and was estimated to have made about $4.1 million before being seized by Russian authorities in February 2022. BidenCash was launched later that month.

Update June 4 2025: BidenCash was seized by the U.S. Government in a coordinated law enforcement operation that included the U.S. Secret Service’s Cyber Investigative Section, the U.S. Secret Service’s Frankfurt Resident Office, and the FBI Albuquerque Field Office. Searchlight Cyber provided technical capabilities to support the operation.

The operation involved the seizure of 145 dark web and traditional internet domains, and cryptocurrency funds associated with the marketplace. According to the U.S. Department of Justice, the BidenCash marketplace domains are no longer operational and will redirect to a U.S. law enforcement-controlled server, preventing future criminal activity on these sites.

As part of its statement, the DoJ also released figures on the activity of the marketplace. According to their press release, the BidenCash marketplace had more than 117,000 customers and facilitated the trafficking of more than 15 million payment card numbers and personally identifiable information, generating more than $17 million in revenue during its operations.

‍

BlackPass

‍

Active Since: May 2017

Dark Web or Clear Web?: Both

‍

BlackPass specializes in stolen login details needed to hijack e-commerce accounts – which often have associated payment data – rather than the card details directly. While all listings include at least the credentials required to log into accounts for sites like Amazon, Venmo, and Instagram, some accounts have PII associated with them such as the victim’s full name, country, ZIP code, bank and card details, and phone number.

BlackPass closely resembles Slilpp, another popular credential autoshop disrupted in a June 2021 multinational law enforcement operation.

‍

BriansClub

‍

Active Since: 2014

Dark Web or Clear Web?: Both

‍

With earliest estimates placing its inception at 2014, BriansClub is the oldest autoshop on this list. It is well known in the cybercriminal underground, not least for its hijacking of security journalist Brian Kreb’s likeness.

BriansClub sells a range of fraud products, including CVVs, fullz (card details packaged with additional cardholder information such as date of birth and social security number), and dumps.

BriansClub also has a wholesale section, selling full databases of stolen card details for bulk buyers.

‍

Genesis [offline]

‍

Active Since: April 2017

Dark Web or Clear Web?: Both

‍

On April 5 2023, the Genesis market was seized as part of the international law enforcement crackdown dubbed “Operation Cookie Monster“.

The operators tried to continue the site solely on Tor but it suffered from setbacks – including a ban from Exploit forum (which had been a key communication and customer service channel for the site) and a drop in bot quality (as alleged by users).

In June it was announced on the forum club2crd that the admins were selling the entire platform (source code, database, infrastructure, etc.) and in July a buyer had been found. Shortly after the deal closed the site went offline and is yet to return.

Genesis had specialized in “browser fingerprints”, which are harvested from computers that have been infected with infostealer malware and often include credentials, payment data, cookies, browsers in use, IP addresses, user-agent strings and operating system details. This information can be used by criminals to bypass anti-fraud solutions (such as MFA or device fingerprinting) by making the browser session appear identical to the victim’s.

At the time it was seized, the UK’s National Crime Agency (NCA) Estimated that the market hosted about 80 million credentials and digital fingerprints stolen from more than two million people.

‍

PatrickStash

‍

Active Since: March 2022

Dark Web or Clear Web?: Both

‍

PatrickStash began being mentioned on cybercrime forums as a viable option for carders in March 2022.

The site’s forum representative is very active in advertising the shop, touting automatic refunds, live statistics, and sellers in a range of countries as their USPs. On this note, the PatrickStash forum account regularly puts out recruitment calls for new vendors to sell to them, garnering a generally positive response.

PatrickStash has two categories, Cards and Cards NoVBV (short for Verified By Visa, now called 3D-Secure, an additional security layer meant to protect against online payment fraud). Despite its overtly Irish theme, the site is more likely to originate from Russia, or at least targets its advertising towards that audience.

‍

PutinCash [offline]

‍

Active Since: November 2023

Clear Web

‍

No doubt inspired by its predecessors TrumpsDumps and BidenCash, PutinCash was another carding shop named after a world leader.

A clear web-only site, PutinCash offered credit card details and dumps (with or without the associated PIN). PutinCash  received a fair amount of attention in the cybercriminal underground – positive and negative – and like Bahira and PatrickStash also fielded applications for sellers, though their usernames were not shown on the site.

‍

RussianMarket

‍

Active Since: February 2019

Dark Web or Clear Web?: Both

‍

RussianMarket specializes in the sale of “logs” – records harvested by information-stealing malware – as well as CVVs, dumps and RDP (remote desktop protocol) access.

Unsurprisingly, it is suspected to be of Russian origin. Indeed, many of the examples of autoshop marketplaces we have listed are assumed to be of Russian origin, based on the language preferences of the sites and the forums used to promote their wares.

Autoshops are also more likely to operate on the clear web but often have some form of entry barrier, such as requiring a minimum account balance or an invite from a known user. In the case of invite-only shops, staff will sometimes distribute invites on hacking forums or customers sell them as a third-party broker on forums or messaging apps such as Telegram.

‍