The Top 10 Dark Web Marketplaces in 2023
Click here to see our 2024 top Dark Web Marketplaces!
The dark web marketplace ecosystem has seen a significant transformation in 2023. Much of the change came in the absence of major marketplaces which have been seized by the authorities or were closed by their admins for various reasons. Some of the big names who have disappeared this year include Genesis, Monopoly Market, ASAP, Alphabay, and Tor2Door.
The shutdowns forced by law enforcement have exposed the vulnerabilities inherent in these marketplaces. It has also forced marketplace users to adapt and seek new platforms and ushered in an era of heightened scrutiny and increased competition among the remaining marketplaces.
What types of marketplaces can you find on the dark web?
Our team classifies marketplaces into two: classic marketplaces and datastores. Classic marketplaces offer tangible illegal goods like drugs and weapons, while datastores exclusively trade in stolen data and tools for illegal activities.
In recent years, some marketplaces have expanded onto platforms like Telegram to broaden their reach and cater to cybercriminals seeking to expand or develop their dark web activities.
What are the top 10 dark web marketplaces?
Track illegal trade, cybercriminal activities, and emerging dark web trends requires deep knowledge of the hidden marketplace space.
We’ve compiled a list of the top 10 leading dark web marketplaces to help gain a better insight into that space. These marketplaces represent a growing ecosystem and were selected because of their increasing popularity, user engagement, and illicit activities.
1. Abacus Market
Main Language: English
Topics:
- Drugs
- Counterfeit
- Digital products (game keys, e-books, etc.)
- Financial fraud (CVV, dumps, PII, etc.)
- Guide and tutorials
- Jewels and gold
- Services
- Software & malware (botnet, exploits kits, etc.)
About Abacus Market: Abacus Market is a well-established dark web platform that offers diverse products, including drugs, digital goods, and counterfeits. Notably, it hosts a forum for community support, features an extended search function, and accepts Bitcoin and Monero as payment methods. As of 2023, Abacus boasts one of the largest product selections among darknet markets.
2. STYX Market
Main Language: English
Topics:
- BINs (CC)
- RDP/VDS/VPS
- Verified crypto accounts
- Bank accounts
- Credit cards
- Data from stealer logs
- Email accounts
- Stolen documents
About STYX Market: STYX Market was launched this year and became a prominent darknet in 2023. It is a hotspot for financial cybercrime, offering illicit services like fraud, money laundering, and stolen data. It operates alongside a Telegram channel facilitating direct communication between buyers and sellers.
STYX focuses on illegal financial activities, including digital banking hacks and cryptocurrency access, often involving substantial transaction amounts. This marketplace poses a significant challenge to financial institutions and law enforcement agencies, serving as a hub for sophisticated financial fraud on the dark web.
3. Brian’s Club
Main Language: English
Topics:
- News
- Dumps
- CVV
- Fullz – full information per card (credit card number, CVV, expiry date, account name)
- Wholesale – a sale of full account details
- Auction – for bidding and outbidding other users who want to purchase unique BINs
About Brian’s Club: Brian’s Club, also known as BrianCC, is a credit card shop (or what we call “datastore”) that offers stolen credit card-related PII and data – CVVs, packages of Fullz (full information per card), credit cards per country, and more.
This datastore is considered reliable and very active, and its offerings are known to be a bit more expensive in comparison to the Russian Market (see marketplace #4). A unique feature of Brian’s Club is the auctions they run, in which users can reserve, bid, and outbid other users who want to purchase unique BINs.
BrianCC also has internal searching tools for looking up different breached assets – SSNs, CVV, credit card numbers, and BINs, including billing addresses and zip codes. They allow payment in Bitcoin, Litecoin, and Cryptocheck.
We have used our dark web monitoring tool Lunar to see how popular this site is and we have identified an increase in the volume of activity on this site over the past year.
This is a clear indication that the activity on Brian’s Club is growing and that it has positioned itself as a top datastore.
4. Russian Market
Main Language: English
Topics:
- CVV – prepaid cards
- Dumps – stolen credit cards
- RDP – access to a client or server
- Stealer logs – stolen digital fingerprints (cookies, login details, and IPs)
- PROs – Stolen accounts per domain
About Russian Market: Russian Market is a renowned, and reliable datastore. It specializes in PII trade and the sale of brand-related data, such as RDP & SSH access, PayPal account logins, IP addresses, cookies, credentials of users, and data of stolen credit cards.
Although its name might be confusing, Russian Market operates in English and doesn’t necessarily have a link to Russia or Russian speakers. The prices of the products listed on the site tend to range between a few tens of dollars to a few hundred dollars (payment is accepted in Bitcoin, Litecoin, or Ethereum). This makes it pretty affordable. The site offers some built-in tools such as a Bin Checker, Paypal Cookie Converter, Track1 Generator, and a script to convert Netscape to JSON cookies.
Just like Brian’s Club, Russian Market’s activity has also increased in 2023, keeping it at the forefront of dark web marketplaces:
5. Nemesis Market
Main Language: English
Topics:
- Drugs
- Fraud
- Hacking (tools, services, breached data, etc.)
- Counterfeits
- Guides and tutorials
About Nemesis Market: Nemesis, which was launched in May 2021, stands out in this list as it diverges from the classic dark web markets by not primarily focusing on drug sales, although drugs are still available. Instead, it specializes in the trade of guides, tutorials, and carding (acquiring or purchasing credit card details for various illicit purposes). This information can be exploited to acquire high-value items or prepaid cards that are either used by the attacker or sold for profit.
6. Vice City
Main Language: English
Topics:
- Drugs
- Digital (E-books, fraud software, game keys, etc.)
- Fraud-affected account
- Counterfeits listings
About Vice City: Vice City is a known TOR-based “classic marketplace”, which means that its listings consist of illegal products, such as different drugs, fraud services, and fake certificates and products. However, it prohibits the sale of weapons, hitmen, and stolen data of all kinds. Payment is accepted either in dollars or in Bitcoin. The products offered for sale are ranked by users, helping other users get a better experience. Vice City takes stringent measures to stay safe and hidden – keeping the site a closed marketplace. Two of those measures are complicated CAPTCHA and anti-bot tests it forces new users to take.
7. BidenCash
Main Language: English
Topics:
- Credit cards
- Personal Identifiable Information (PII)
- Secure Shell Protocol (SSH)
About BidenCash: BidenCash is a platform that was established in 2022, and is specializing in payment card data, a staple in cybercrime circles known as CVVs (vital for fraudulent online purchases), dumps (raw magnetic strip data for forging cards), or fullz, obtained from various databases.
The listings on BidenCash vary and they typically contain the card’s BIN, security code, expiration date, and type (e.g., Visa or Mastercard, credit or debit). Some listings go further by including personal identifying information (PII) such as the victim’s date of birth, social security number, phone number, email, and physical address. BidenCash also promotes its site by releasing free databases on underground forums.
8. Cypher
Main language: Russian
Topics:
- Guides and tutorials
- Drugs
- Other listings – such as doxxing tools, gold, invites to invite-only Genesis marketplace, Binance accounts, password databases, and more.
- Counterfeit
- Hosting and security
- Software and malware
About Cypher: Cypher lists drug-related products, malware, and financial fraud-related products. While Cypher offers a variety of goods for sale, it prohibits the trade of weapons, explosives, and dangerous chemicals. It also bans any kind of services relating to murder, any form of child pornography, and the sale of private information (doxxing). The products on Cypher are considered cheaper in comparison to rival markets and can cost only tens of dollars.
9. Kingdom Market
Main language: English
Topics:
- Drugs
- Illicit services
- Security and hosting
- Jewelry and art
- Identification
- Guides and tutorials
- Fraud
- Counterfeit
- Software and malware
- Carded items
About Kingdom Market: This site is considered a classic marketplace and hosts listings of various illegal products such as drugs, fake IDs, stolen credit cards, and prepaid accounts to platforms. The market’s admins require users to pass difficult anti-bot tests to keep the space hidden and safe for its users. The prices on Kingdom Market range from a few dollars up to hundreds of dollars.
10. Real And Rare
Main Language: English
Topics:
- CVVs
- Dumps
- databases of SSN and DOB (date of birth)
- CVV, Dump, and Bin checker
- Track1 generator
About Real And Rare: Established in 2020, Real and Rare has gained a reputation for its stability with minimal downtimes. It continually expands its offerings, now operating through an active Telegram channel for selling stolen credit card details and announcing new dumps. The platform serves both vendors and consumers and incentivizes users with a referral program, offering a 10% commission for every purchase made by referred customers. With competitive pricing and a vast volume of credit card information listings, Real and Rare has become a prominent platform for trading credit card information online.
Why should you monitor dark web marketplaces?
Dark web marketplaces are widely used by cybercriminals to access a wide range of illegal goods and services, gain knowledge and expertise across various criminal domains, and grow their criminal networks. These marketplaces continually expand their illicit product offering, and new markets emerge all the time. Because of their strong emphasis on security and anonymity, it is challenging to keep track of illegal activities and threats effectively. To help with this growing challenge, Webz.io offers a stable and continuous flow of information from illegal online marketplaces through a dark web API and offers a dark web monitoring tool, Lunar, that helps analysts easily investigate these hidden illicit activities.
