Dark web marketplaces are a platform for trading illicit products on a small and large scale. The products that are most commonly listed for sale include drugs, fake documents, fraud-related items, and hacking services and tools. The prices for these products range from a few dollars to hundreds and thousands of dollars, depending on how valuable the stolen or illegal product is and on how experienced and known the vendor and platform are. 

The marketplaces are usually managed by an admin or a small group of admins, and the typical users of the marketplaces are cybercriminals who search for illegal products online that will help their own illicit activities.

What types of marketplaces can you find on the dark web?

We usually classify dark web marketplaces into two groups, based on their content and listings: classic marketplaces and data stores (a term we coined – see definition below). 

Classic marketplaces are the original marketplaces dark web threat actors are associated with, where they sell illegal tangible products, such as drugs, weapons, gift cards, and prepaid cards. 

Data stores are dark web marketplaces that only sell data – stolen sensitive data, and data that support illegal activities, such as stolen credit card details, bank account details, hacking tutorials, cracking methods for breaching platforms, access to a brand services/networks/accounts, etc. 

In recent years, some marketplaces have also expanded their networks and started running parallel channels on Telegram in order to spread their reach, which spread their activity and made them more accessible to cybercriminals who seek to improve their own performance and dark web activity online.

How can you determine where a marketplace is located?

When looking at the marketplaces as a whole, it is important to note that the origins of marketplaces and their admins tend to remain vague, at least most of the time. Admins aren’t eager to expose their nationality or locations, or what country they’re associated with, in order to stay anonymous and untraceable. Three exceptions to this general rule are:

• WeTheNorth – a marketplace that positions itself as “the” Canadian marketplace, since it first emerged shortly after the known Canadian HQ marketplace was closed.
• Cocorico – a French marketplace that operates in French and provides services across Europe.
• Cypher – a proud Russian marketplace.

To help you trace the illegal trade of products, cybercriminal activity, and the hottest dark web trends, we have compiled a list of the top 10 leading dark web marketplaces.

These marketplaces are a part of a long list of active markets that are gaining momentum, audiences, and illegal activity every day. We tried to represent the wide range of marketplaces that exist within this list. The languages that are listed are only an indication of the language the marketplace is using rather than an indication of its origin or the nationality of its admins.

Here are the top dark web marketplaces:

Main language: English

Topics: 

• CVV – prepaid cards
• Dumps – stolen credit cards
• RDP – access to a client or server
• Stealer logs – stolen digital fingerprints (cookies, login details, and IPs)
• PROs – Stolen accounts per domain

About Russian Market: Russian Market is considered to be one of the most popular, reliable, and valuable data stores. It specializes in the sale of PII and brand-related data, such as RDP & SSH access, Paypal account logins, IP addresses, cookies, credentials of users, and data of stolen credit cards. 

Unlike the name implies, Russian Market operates in English and doesn’t necessarily have a link to Russia or Russian speakers. The prices of the products listed on the site tend to range between a few tens of dollars to a few hundred of dollars (payment is accepted in Bitcoin, Litecoin, or Ethereum). This makes it pretty affordable. The site offers some built-in tools such as a Bin Checker, Paypal Cookie Converter, Track1 Generator, and a script to convert Netscape to JSON cookies.

Main language: English

Topics:

• News
• Dumps
• CVV
• Fullz – full information per card (credit card number, CVV, expiry date, account name)
• Wholesale – a sale of full account details
• Auction – for bidding and outbidding other users who want to purchase unique BINs

About BrianCC: BrianCC, which stands for Brian’s Crabs Club, is a credit cards shop (data store) that specializes in the sale of stolen credit card related PII and data – CVVs, packages of Fullz (full information per card), credit cards per country, and more. 

BrianCC is known to be reliable and very active, and a bit more expensive in comparison to Russian Market. A rather unique feature of Brian’s Club is the auctions they run, in which users can reserve, bid, and outbid other users who want to purchase unique BINs. BrianCC also has internal searching tools for looking up different breached assets – SSNs, CVV, credit card numbers, BINs, including billing address and zip codes. They allow payment in Bitcoin, Litecoin, and Cryptocheck.

Main language: English

Topics:

• Drugs
• Digital (E-books, Fraud software, Game keys, etc.)
• Fraud affected account
• Counterfeits listings

About Vice City: Vice City is a popular and well-known TOR-based marketplace that operates as a classic marketplace, which means that its listings consist of illegal products, such as a wide range of drugs, fraud services, and fake certificates and products. It does however prohibit the sale of weapons, hitmen, and stolen data of all kinds. Payment is accepted either in dollars or Bitcoin. The products offered for sale are ranked for the convenience of the users.  Vice City takes tough measures to keep it hidden – as a closed marketplace. One of those measures is the hard CAPTCHA and anti-bot tests it uses.

• 

• 

Main language: English (Canadian)

Topics: 

• Fraud
• Drugs and chemicals
• Guides and tutorials
• Counterfeit items
• Digital products
• Jewels and gold
• Carded items
• Illicit services
• Software and malware

About WeTheNorth: The marketplace was launched in 2021, and its logo seemed to be a play on the Toronto Raptors basketball team slogan. WeTheNorth was likely created to replace the Canadian HQ marketplace that was closed. A possible link that proves it is that WeTheNorth was first spotted in discussions about new marketplaces on the web in July 2021, the same month the activity on Canadian HQ ceased. The new dark web market offers a variety of illegal goods and services for sale. WeTheNorth is unique in the way it protects both Canadian buyers and sellers, creating a relatively safe marketplace for its users, and keeping a “clean reputation”.

Main language: English

Topics: 

• Vulnerabilities and exploits – malicious access to several networks and platforms
• PII such as stolen browser cookies, and credentials.

About Genesis Market: This market is an invite-only data store, which was launched in 2018. It specializes in the sale of login credentials, cookies, device fingerprints/trackers, website vulnerabilities, and other sensitive data that can be used by hackers to circumvent security measures and protocols. 

Digital profiles such as these, which are planted on users’ computers after they log into a website or application, contain passwords, and other personal information for services such as Gmail, Netflix, Spotify, etc., and that’s one of the reasons Genesis is considered very valuable and appreciated by hackers and threat actors. Genesis Market sells “bots” (unrelated to automated software programs bots) that store stolen account credentials to online services, from Netflix and Amazon to PayPal. The Genesis Market bots will give their buyers access to other people’s accounts. Bots were Genesis’ first offering when it first launched, and today there are over 400,000 bots for sale on the site. Genesis is linked to a number of known cyberattacks, including a breach of video game publisher Electronic Arts in June 2021 that resulted in the loss of sensitive data, including the source code for the game FIFA 2021.

Main language: English

Topics: 

• Drugs
• Illicit services
• Security and hosting
• Jewelry and art
• Identification
• Guides and tutorials
• Fraud
• Counterfeit
• Software and malware
•  Carded items

About Kingdom Market: This dark web market is an example of what we call a classic marketplace, which hosts listings of various illegal products such as drugs, fake IDs, stolen credit cards, and prepaid accounts to platforms. To keep their market a botless space and to ensure its users are not subject to abuse, the market’s admins require users to pass a difficult anti-bot test. They then protect users from phishing and exit scams by showing them the original, active domains of the site The prices on Kingdom Market range from a few dollars up to hundreds of dollars.

Main language: English

Topics: 

• All types of drugs
• Counterfeit items
• Digital goods and services

About Royal Market: Royal Market is one the most popular and active dark web marketplaces since it was first launched in 2021. It already has over 9,500 listings. This includes the sale of drugs as well as fake documents and hacking and fraud services and lists of tens of thousands of illegal products offered for sale. Product prices can reach thousands of dollars, as sellers and buyers trust the marketplace, and payment is accepted in dollars, Bitcoin, and Monero currency. Besides the product listing on the homepage, there are also custom shops for hundreds of the Royal Market’s active vendors and even a separate Royal Market forum section.

Main language: French

Topics: 

• Drugs 
• Fraud services

About Cocorico: Cocorico has both a marketplace and a forum with over 1,000 active users. It was established in 2021 and sells a variety of items but primarily drugs in France and to other EU countries, with some sent outside of Europe. What makes Cocorico special is the fact that its default language is French, and while it can be changed to English, some products and features will not be fully translated into English.

Main language/Origin: English

Topics: 

• Fraud
• Hacking and spam
• Malware
• Drugs and chemicals
• Illicit services
• Security and hosting
• Guides and tutorials
• Software
• Digital items
• Websites and graphic design
• Jewels and precious metal
• Counterfeit items
• Carded items
• Automotive-related items

About AlphaBay: AlphaBay was first launched in 2014, and made a comeback to the dark web earlier this year (2022) after it went down in July 2017. Both its market and forum are rich with illegal content and have a large range of illegal product listings and discussions. 

Each market category has subcategories and several related items are offered for sale on each, making AlphaBay one of the most popular and unique dark web marketplaces since it operates both as a classic marketplace and a data store. This makes it valuable for both conventional crime and cybercrime actors. AlphaBay’s marketplace and forum are also available on the darknet I2P.

Main language: Russian

Topics: 

• Guides and tutorials
• Drugs
• Other listings – such as doxxing tools, gold, invites to invite-only Genesis marketplace, Binance accounts, password databases, and more.
• Counterfeit
• Hosting and security
• Software and malware

About Cypher: Although the homepage of Cypher lists mostly drug-related products, it also features some malware and financial-fraud related products, which make the marketplace popular among Russian and global users. By looking at its categories, Cypher appears to be an all-purpose market, but it prohibits the sale of weapons and explosives, as well as any other dangerous chemicals. It also bans any kind of murder-related services, any form of child pornography, and private information (doxing). The products on Cypher are considered cheaper in comparison to rival markets and can cost only tens of dollars.

Why monitor dark web marketplaces?

Dark web marketplaces are fertile ground for cybercriminals who use them to expand their network, activity, supplies, and knowledge of various criminal fields. Dangerous illegal products are added and bought on these marketplaces on an hourly basis, and more and more markets launch a matching forum to keep expanding and supporting criminal web activity. As to security and anonymity, marketplaces guarantee their users privacy and protection, which provide threat actors with a safe and optimal environment for their illegal activities.