The Top 7 Dark Web Marketplaces in 2024
The dark web remains a critical resource for criminals, offering a diverse range of illicit products and services that continue to fuel cyber threats worldwide. Over the past year, we’ve seen the landscape of dark web marketplaces transform significantly, driven by an increase in law enforcement actions, technological advancements, and shifting user behaviors.
Several high-profile marketplaces closed in 2024 due to successful law enforcement operations. These closures disrupted the dark web economy and forced cybercriminals to adapt, leading to the emergence of new, more secure platforms. Criminals also expanded their reach by integrating dark web marketplaces with mainstream platforms like Telegram. These integrations make connecting and trading information and services easier for cybercriminals.
This article provides an in-depth analysis of the top 7 dark web marketplaces in 2024, including key trends we’ve observed this year so far. Whether you’re a cybersecurity professional, researcher, or simply interested in the dark web, this article will help you navigate this ever-evolving landscape.
Types of Dark Web Marketplaces
The dark web hosts a variety of marketplaces, each catering to different aspects of illicit trade. We broadly categorize dark web marketplaces into two main types: Classic Marketplaces and Data Stores.
Classic Marketplaces
Classic marketplaces are the traditional dark web marketplaces known for their wide range of tangible illegal goods. They operate similarly to conventional e-commerce sites, offering various illicit products, such as:
- Drugs: Recreational and prescription drugs are sold in large quantities, with many sourced from international suppliers.
- Counterfeit Items: Fake documents such as passports, driver’s licenses, and various forms of identification are widely available.
- Weapons: They enable the sale of firearms, explosives, and other weapons, although their sale is increasingly regulated and monitored.
- Digital Products: Many digital products are available, including e-books, fraud software, game keys, and counterfeit software licenses.
- Illicit Services: These marketplaces enable various criminal activities, such as hacking for hire, malware development, and hitman services (though less common).
Classic marketplaces typically have extensive security measures to protect the anonymity of buyers and sellers. These measures include the use of cryptocurrencies for transactions, encrypted communications, and strict vetting processes for new users.
Data Stores
Data stores focus exclusively on the sale of digital and informational goods. They cater to cybercriminals looking for sensitive data and tools to aid in their illegal activities. Common items found on data stores include:
- Stolen Data: This includes personally identifiable information (PII), credit card details, bank account information, and login credentials.
- Hacking Tools: Data stores offer various tools for cyber criminals, including malware, exploit kits, phishing kits, and botnets.
- Access Credentials: This includes forms of unauthorized entry to systems and networks, such as Remote Desktop Protocol (RDP) access and Secure Shell (SSH) access.
- Fraud Guides and Tutorials: These marketplaces often provide detailed guides on how to commit various types of fraud, including identity theft and credit card fraud.
- Digital Fingerprints: Criminals can find collections of cookies, browser information, and other digital fingerprints that they can use to bypass security measures.
Data stores have become increasingly popular with cyber criminals due to their growing demand for information that they can use to facilitate cyberattacks. These platforms typically utilize advanced security protocols to maintain the anonymity and safety of their users.
Integration with Mainstream Platforms
In recent years, some dark web marketplaces have expanded their operations to mainstream platforms like Telegram. This integration allows these marketplaces to reach a broader audience and facilitate transactions more easily. Telegram channels and groups have become popular for trading illicit goods, sharing information, and coordinating activities. This shift has made it even more challenging for law enforcement agencies to monitor and stop illegal operations.
Dark Web Marketplace Trends in 2024
We’ve seen several significant trends happening in the dark web marketplace landscape in 2024. These trends reflect the ongoing evolution and adaptation of cybercriminal activities. Here are some of the most noteworthy trends we observed this year:
1. Law Enforcement Crackdowns
One of the most impactful trends in 2024 has been the increased number of successful law enforcement operations targeting dark web marketplaces. Authorities worldwide have intensified their efforts to crack down on dark web marketplaces, leading to several high-profile shutdowns. These crackdowns have disrupted many cybercriminal operations, forcing criminals to seek new, more secure venues.
2. Emergence of New Platforms
In response to the closures of established marketplaces, new platforms have emerged to fill the void. These new platforms typically have enhanced security features like multi-factor authentication (MFA), encrypted communications, and stricter vetting processes for new users. The rapid rise of new platforms highlights the resilience and adaptability of the dark web ecosystem.
3. Integration with Mainstream Platforms
An increasing number of dark web marketplaces have integrated with mainstream communication platforms like Telegram and Discord, broadening their reach. The integrations make it easier for cybercriminals to connect, trade, and share information. Mainstream platforms include advanced features like end-to-end encryption, which help ensure anonymity and strengthen the security of transactions and communications.
4. Increased Scrutiny and Competition
Heightened law enforcement activity and the emergence of new marketplaces have led to increased scrutiny and competition among the remaining dark web marketplaces. Many invest in better security measures to protect their users and maintain their reputations. This fierce competition is driving innovation in how these platforms operate and resulting in the adoption of more sophisticated anonymity tools and payment methods.
5. Diversification of Products and Services
Dark web marketplaces continue to diversify their offerings. In addition to traditional items like drugs and counterfeit goods, there is a growing demand for digital products, including stolen data, hacking tools, and fraud guides. Cybercriminals also have an increasing demand for more specialized services, such as custom malware development, ransomware-as-a-service (RaaS), and phishing kits.
6. Greater Acceptance of Different Cryptocurrencies
Bitcoin remains the primary payment method for transactions on dark web marketplaces. However, in 2024, we’ve seen a greater acceptance of cryptocurrencies beyond Bitcoin, such as Monero, Ethereum, and Litecoin. These cryptocurrencies offer different levels of anonymity and transaction speed, catering to the diverse needs of dark web users.
You can see these trends in many of the top marketplaces on the dark web.
The Top Dark Web Marketplaces in 2024
Based on our observations from analysis on dark web data using Lunar, we’ve identified the top 7 marketplaces on the dark web in 2024. Lunar is a tool we’ve developed to monitor the deep and dark web.
Abacus Market
Since its inception in September 2021, Abacus Market has established itself as one of the leading dark web marketplaces. It quickly rose to prominence following the closure of AlphaBay, once touted as the world’s largest underground darknet marketplace. Abacus Market quickly rose to prominence by attracting former AlphaBay users and providing a comprehensive platform for a wide range of illicit activities.
Main Language
- English
Topics and Products Sold
Abacus Market offers an extensive array of illegal goods and services across various categories, making it one of the most versatile marketplaces on the dark web. The primary categories include:
● Drugs and Chemicals: This is the largest section of the marketplace, featuring thousands of listings for various drugs, including recreational drugs, prescription medications, and chemical precursors.
● Counterfeit Items: The market offers a range of fake documents, including passports, driver’s licenses, and other forms of identification.
● Digital Products: Criminals can find many electronic goods, including e-books, software keys, and digital accounts.
● Financial Fraud: The market offers many items for financial fraud, including stolen credit card information (CVVs, dumps), bank account details, and PII.
● Guides and Tutorials: The market provides detailed instructions on how to commit various types of cybercrime, including hacking, phishing, and financial fraud.
● Services: Criminals often offer illicit services through Abacus Market, which includes hacking-for-hire and money laundering.
● Software and Malware: Criminals can find various hacking tools on the marketplace, such as malicious software and exploit kits.
Unique Features
Abacus Market distinguishes itself with several unique features that enhance its appeal and functionality for users:
● Extensive Product Selection: With over 40K products listed, Abacus Market offers one of the largest selections of illegal goods and services on the dark web.
● Community Support: The marketplace hosts a forum where users can discuss various topics, share tips, and provide support to each other.
● Advanced Search Function: Abacus Market features a sophisticated search tool that allows users to quickly find specific products or services.
● Security Measures: The marketplace employs robust security protocols, including two-factor Authentication (2FA) and extensive phishing warnings to ensure user safety and anonymity.
● Payment Methods: Abacus Market accepts multiple cryptocurrencies, including Bitcoin and Monero, providing flexibility and anonymity for transactions.
Market Value and Popularity
As of 2024, Abacus Market is valued at approximately $15 million, making it one of the most lucrative platforms in the dark web ecosystem. Its popularity has grown significantly over the past year, partly due to the strategic absorption of users from other recently shut-down marketplaces, such as AlphaBay and Incognito Market.
STYX Market
Launched in early 2023, STYX Market is among the most prominent newcomers to the dark web marketplace scene. It is a hub for financial cybercrime, offering a wide range of illicit services and stolen data that cater to sophisticated cybercriminals.
Main Language
- English
Topics and Products Sold
STYX Market’s primary categories for products and services include:
● BINs (Bank Identification Numbers): Collections of credit and debit card numbers for use in fraudulent transactions.
● RDP/VDS/VPS Access: Remote Desktop Protocol access, Virtual Dedicated Servers (VDS), and Virtual Private Servers (VPS) compromised or configured for illegal activities.
● Verified Crypto Accounts: Accounts for cryptocurrency exchanges that have been verified, allowing for easier money laundering and fraud.
● Bank Accounts: Stolen bank account details, including login credentials and account information.
● Credit Cards: Collections of stolen credit card data, including CVVs, dumps, and full card information (Fullz).
● Data from Stealer Logs: Information harvested from malware infections, including usernames, passwords, and session cookies.
● Email Accounts: Access to compromised email accounts, often used for further phishing or fraud attempts.
● Stolen Documents: Fake or stolen identification documents, such as passports and driver’s licenses.
Unique Features
STYX Market has several unique features that make it stand out among dark web marketplaces:
● Financial Cybercrime Focus: Unlike many other marketplaces that offer a broad range of products, STYX Market focuses specifically on financial fraud, making it a go-to destination for cybercriminals engaged in this activity.
● Integration with Telegram: The marketplace operates alongside a Telegram channel, which facilitates direct communication between buyers and sellers. This integration allows for real-time updates, support, and transactions, enhancing user experience and operational efficiency.
● High-Value Transactions: STYX Market often involves substantial transaction amounts, reflecting the high-value nature of the financial data and services it offers.
● User Verification: To maintain trust and security, STYX Market requires users to undergo a verification process, ensuring that only serious and legitimate buyers and sellers can participate.
● Payment Methods: The marketplace accepts various cryptocurrencies, including Bitcoin and Monero, providing users with secure and anonymous transaction options.
Market Value and Popularity
Since its launch, STYX Market has rapidly gained traction among cybercriminals, establishing itself as a key player in the dark web ecosystem. Its focus on financial fraud and high-value transactions has attracted a dedicated user base, contributing to its growing reputation and market value.
Brian’s Club
Operating since at least 2014, Brian’s Club, also known as BrianCC, is one of the most notorious credit card shops on the dark web. It has built a reputation for being a reliable source of stolen credit card data and PII. This marketplace is renowned for its extensive inventory of financial data and sophisticated operations, making it a key player in the underground economy of financial cybercrime.
Main Language
- English
Topics and Products Sold
Brian’s Club’s primary product and service categories include:
● Dumps: Raw magnetic stripe data from credit cards, which can be used to create cloned cards for in-person transactions.
● CVVs: Card verification values which are crucial for conducting fraudulent online transactions.
● Fullz: Comprehensive sets of personal information linked to credit card accounts, including card numbers, CVVs, expiration dates, account holder names, and addresses.
● Wholesale Accounts: Bulk sales of full account details, catering to buyers looking for large quantities of data.
● Auction Listings: Auctions where users can bid on high-value or unique data sets, allowing for competitive pricing and access to premium data.
Unique Features
Brian’s Club has several distinctive features that set it apart from other dark web marketplaces:
● Auctions: The platform’s auction feature allows users to reserve, bid, and outbid others for unique and high-value BINs. This competitive aspect attracts serious buyers looking for exclusive data.
● Internal Search Tools: Brian’s Club offers advanced search capabilities, enabling users to filter and find specific breached assets such as Social Security Numbers (SSNs), CVVs, credit card numbers, and billing addresses.
● Cryptocurrency Payments: The marketplace accepts multiple cryptocurrencies, including Bitcoin, Litecoin, and Cryptocheck, ensuring anonymous and secure transactions.
● Reputation for Reliability: Brian’s Club has built a reputation for consistently providing high-quality and valid data over the years. This reliability has earned it a loyal customer base.
● Regular Updates: The platform frequently updates its inventory, adding new batches of stolen data to keep up with demand and maintain its relevance in the market.
Market Value and Popularity
Brian’s Club has maintained a significant presence in the dark web ecosystem due to its extensive inventory and reputation for reliability. Although it is considered more expensive than some other marketplaces, the higher cost is justified by the quality and validity of the data it offers. The platform’s popularity continues to grow, attracting both new and returning customers.
Russian Market
Established in 2019, Russian Market is a well-known and highly regarded data store on the dark web, specializing in the sale of PII and various forms of stolen data. Despite its name, the marketplace operates primarily in English and serves a global audience. It has gained a reputation for being a reliable source of high-quality data for cybercriminals.
Main Language
- English
Topics and Products Sold
Russian Market’s primary categories include:
● CVVs: Card verification values used for online transactions and conducting fraudulent purchases.
● Dumps: Magnetic stripe data from credit cards, which can be used to create cloned cards for physical transactions.
● RDP Access: Remote Desktop Protocol access credentials, allowing attackers to remotely control compromised systems.
● Stealer Logs: Collections of stolen digital fingerprints harvested from infected devices. Collections can include cookies, login details, and IP addresses.
● PII Data: Comprehensive personal information, including names, addresses, and social security numbers.
● Tools and Utilities: Various built-in tools such as BIN checkers, PayPal cookie converters, and generators for Track1 data and Netscape-to-JSON cookies.
Unique Features
Russian Market stands out due to several unique features and offerings:
● Affordable Prices: The marketplace is known for its competitive pricing, with products ranging from a few dollars to a few hundred dollars, making it accessible to a wide range of buyers.
● Built-in Tools: Russian Market offers several useful tools for cybercriminals, including BIN checkers, PayPal cookie converters, and various data conversion scripts. These tools enhance the usability and value of the data sold on the platform.
● Wide Range of Data: The marketplace provides a diverse array of stolen data, catering to cybercriminals’ different needs and preferences.
● Reputation for Reliability: Over the years, Russian Market has built a reputation for offering valid and high-quality data, attracting a steady stream of customers.
Market Value and Popularity
Russian Market has consistently remained one of the most popular and valuable data stores on the dark web. Its affordability and reliability have earned it a loyal customer base. The platform’s activity has increased significantly over the past year, indicating its growing influence and market share in the underground economy.
Vice City
Vice City is a well-known dark web marketplace that has established itself as a significant player in the realm of illicit trade. Operating as a “classic marketplace,” Vice City offers a wide range of illegal products, maintaining strict regulations on the types of items allowed for sale. Since its inception, Vice City has garnered a reputation for being a secure and user-friendly platform for those engaging in various illegal activities.
Main Language
- English
Topics and Products Sold
Vice City’s primary categories include:
● Drugs: A comprehensive selection of recreational and prescription drugs, including cannabis, psychedelics, stimulants, and opioids.
● Digital Goods: Fraudulent software, e-books, game keys, and other digital products that can aid in cybercriminal activities.
● Fraud-Affected Accounts: Compromised accounts that can be used for fraudulent activities, including banking and social media accounts.
● Counterfeit Items: Fake identification documents such as passports, driver’s licenses, and other official IDs.
Unique Features
Vice City has several unique features that set it apart from other dark web marketplaces:
● Strict Regulations: Vice City enforces strict rules against selling specific items, such as weapons, hitmen services, and stolen data. This focus helps maintain a specific marketplace environment, catering to users interested in particular categories of illegal goods.
● Closed Marketplace: To ensure security and exclusivity, Vice City operates as a closed marketplace, requiring new users to pass stringent CAPTCHA and anti-bot tests before gaining access. This reduces the risk of law enforcement infiltration and keeps the platform more secure.
● User Rankings: Products on Vice City are ranked by users, providing a reliable feedback system that helps buyers make informed decisions based on the experiences of others.
● Payment Methods: Transactions on Vice City can be made using Bitcoin, providing anonymity and security for both buyers and sellers. The marketplace also accepts payments in dollars, adding flexibility for users.
Market Value and Popularity
Vice City has maintained a strong presence in the dark web ecosystem due to its wide range of products and user-friendly features. The marketplace’s popularity is bolstered by its reputation for reliability and security, attracting a steady stream of users seeking specific categories of illegal goods. Despite its restrictive entry requirements, Vice City thrives as a go-to platform for cybercriminals and other illicit traders.
BidenCash
BidenCash is a relatively new entrant to the dark web marketplace scene, having been established in 2022. Despite its recent inception, it has quickly gained notoriety for its focus on the sale of stolen credit card data and PII. BidenCash is known for its aggressive marketing tactics, including releasing large amounts of stolen data for free to promote its services.
Main Language
- English
Topics and Products Sold
BidenCash’s primary categories include:
● Credit Cards: Detailed credit card information, including card numbers, expiration dates, CVVs, and full account holder details.
● PII Data: Comprehensive sets of personal information such as names, addresses, social security numbers, phone numbers, and email addresses.
● SSH Credentials: Stolen SSH credentials that provide access to compromised servers and networks.
Unique Features
BidenCash has several unique features that distinguish it from other dark web marketplaces:
● Free Data Dumps: To attract attention and new customers, BidenCash periodically releases large datasets of stolen credit card information and PII for free on underground forums. These promotional dumps serve as both a marketing tactic and a demonstration of the quality of their data.
● Aggressive Marketing: BidenCash proactively markets its services, leveraging various dark web forums and communities to announce new dumps and offerings.
● User Verification: The marketplace requires users to undergo a verification process to ensure the seriousness and legitimacy of its participants, creating a more secure trading environment.
● Cryptocurrency Payments: Transactions on BidenCash are conducted using cryptocurrencies like Bitcoin and Monero, which offer anonymity and security for both buyers and sellers.
Market Value and Popularity
Since its launch, BidenCash has quickly risen in popularity due to its aggressive marketing strategies and the quality of its data. The marketplace’s focus on financial data and PII has helped dramatically grow its user base, making it a notable player in the dark web’s financial cybercrime ecosystem. Its regular data dumps have helped it gain visibility and credibility among cybercriminals.
WeTheNorth
Launched in June 2021, WeTheNorth is a dark web marketplace that has gained considerable attention for its focus on serving the Canadian market, although it also caters to international users. It has quickly become a prominent player in the dark web ecosystem, offering a wide range of illicit goods and services with a particular emphasis on reliability and user security.
Main Language
- English (Canadian)
- French
Topics and Products Sold
WeTheNorth’s primary categories include:
● Fraud: Tools and services for committing financial fraud, including stolen credit card information (CVVs, dumps), bank account details, and PII.
● Guides and Tutorials: Detailed guides and tutorials on cybercriminal activities, including hacking, fraud, and other illegal activities.
● Counterfeit Items: Fake identification documents, such as passports and driver’s licenses.
● Digital Products: E-books, software keys, game keys, and other digital goods that can be used for fraud.
● Carded Items: Products obtained through fraudulent means using stolen credit card information.
● Services: Various illicit services, including hacking-for-hire and counterfeit currency production.
● Software and Malware: Hacking tools, malware, and other software used for cybercriminal activities.
● Security and Hosting: Secure hosting solutions, VPN services, and other privacy-enhancing technologies.
Unique Features
WeTheNorth has several distinctive features that enhance its appeal and functionality for users:
● Focus on the Canadian Market: While WeTheNorth serves international users, it uniquely positions itself as a marketplace catering to Canadian buyers and sellers. This focus is evident in its branding and the types of products and services it prioritizes.
● Dual Language Support: The marketplace supports English and French, accommodating a broader audience within Canada and beyond.
● User Verification: WeTheNorth employs a thorough verification process for new users, ensuring the legitimacy and seriousness of its participants. This helps maintain a secure and trustworthy environment.
● Secure Transactions: Transactions on WeTheNorth are conducted using cryptocurrencies such as Bitcoin and Monero, providing anonymity and security for both buyers and sellers.
● Community and Support: The marketplace features forums and support channels where users can discuss various topics, share tips, and assist each other, fostering a sense of community.
Market Value and Popularity
Since its launch, WeTheNorth has gained a significant following, particularly among Canadian users. Its focus on reliability, user security, and a comprehensive range of products and services has contributed to its growing market value and influence. The marketplace is valued at approximately $3 million, reflecting its active and loyal user base.
Why You Should Monitor Dark Web Marketplaces
Cybercriminals rely on dark web marketplaces to access a wide range of illegal goods and services, gain knowledge and expertise across various criminal domains, and grow their criminal networks. These marketplaces continually expand their offerings, resulting in ever-changing underground criminal markets. Because of marketplaces’ strong emphasis on security and anonymity, security professionals and cyber analysts find it challenging to effectively keep track of illegal activities and threats on these platforms.
To overcome these challenges, Webz.io offers a stable and continuous flow of information from dark web marketplaces and a tool to analyze that data. You can access deep and dark web data through our dark web API and perform detailed data analysis with Lunar. These tools help you easily investigate the illicit activities hidden in marketplaces across the dark web.
Interested in learning more about how to monitor dark web marketplaces?
