A dark web marketplace is an online shop where criminals trade illegal goods and services. Most run as Tor onion services and take payment in cryptocurrency. Listings range from drugs and forged documents to the products of cybercrime: stolen data, logins, payment cards, malware and access to company networks.

How it works

• Vendors open accounts, list products and build a reputation through buyer ratings.
• The market often holds payment in escrow until the buyer confirms delivery, and takes a fee.
• Digital goods such as stealer logs or combolists are delivered automatically after payment.
• Markets are frequently shut down by police or close on their own, and traders move to new ones.

The UK NCSC describes how online marketplaces and forums have lowered the barrier to entry for cybercrime, for example by letting criminals sell stolen credentials or buy access instead of building their own tools. MITRE ATT&CK notes that attackers may buy information about victims from dark web or cybercrime black markets.

Why it matters for dark web monitoring

Marketplaces are where stolen company data is turned into money, so they are a key source for dark web monitoring. A listing that names a company’s domain, customers or remote access systems is an early warning that can be acted on before the data is used.

Sources: NCSC: Ransomware, extortion and the cyber crime ecosystem, MITRE ATT&CK T1597: Search Closed Sources