Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cybercrime

Authorities Arrest Administrators of Portal to Dark Web Marketplaces

Two Israeli citizens arrested this week are accused of being the administrators of a website that linked to numerous illegal dark web marketplaces. 

Two Israeli citizens arrested this week are accused of being the administrators of a website that linked to numerous illegal dark web marketplaces. 

Arrested on May 6 in France and Israel, the two are charged with receiving millions of dollars in kickbacks for purchases of illegal goods by individuals referred to dark web marketplaces by their website, DeepDotWeb.

The two had allegedly owned and operated DeepDotWeb since 2013, providing users with direct access to numerous illegal marketplaces where illegal drugs, firearms, malicious software, were being traded, along with hacking tools, stolen financial information and payment cards and other illegal goods. 

Now seized by court order, the website, which is hosted at www.deepdotweb(.)com and also accessible on the Darknet at DeepDot35Wveyd5(.)onion, is estimated to have referred hundreds of thousands of users to dark web marketplaces.

The two, Tal Prihar, 37, an Israeli citizen residing in Brazil, and Michael Phan, 34, an Israeli citizen residing in Israel, were indicted on April 24, 2019. 

According to an indictment unsealed by the U.S. Department of Justice, Prihar and Phan received kickback payments representing commissions on the proceeds from the purchases that individuals made on the dark web marketplaces they were referred to via DeepDotWeb. 

The kickback payments were made in Bitcoin and total over $15 million, the indictment says. To conceal the nature and source of the illegal proceeds, the two transferred the money to other Bitcoin accounts, as well as to bank accounts they controlled in the names of shell companies.

Given that the dark web marketplaces operated on the TOR network, users looking to access them needed to know their exact .onion addresses. DeepDotWeb made it easy for users to access those portals by including pages of hyperlinks to various dark net marketplaces’ .onion addresses.

Advertisement. Scroll to continue reading.

The links included unique account identifiers, so that the individual marketplaces could pay “Referral Bonuses,” to DeepDotWeb. The referral bonuses represented a percentage of the profits of the activities conducted on the marketplace by individuals using these customized referral links. 

Dark web marketplaces accessed using these links included AlphaBay Market, Agora Market, Abraxas Market, Dream Market, Valhalla Market, Hansa Market, TradeRoute Market, Dr. D’s, Wall Street Market, and Tochka Market. 

Nearly a quarter of the orders completed on AlphaBay, one of the largest illegal marketplaces when seized in 2017, were associated with an account created through a DeepDotWeb referral link. Thus, Prihar and Phan received a referral fee for nearly a quarter of all orders made on AlphaBay.

Prihar was the administrator of DeepDotWeb (he registered the domain, made infrastructure payments and maintained control over site content), while Phan was responsible for technical operations (maintaining the website’s day-to-day operation). 

The two received approximately 8,155 Bitcoin in kickback payments from dark net marketplaces, worth around $8,414,173 at the time of each transaction. The virtual currency’s fluctuating exchange rate, however, increased the value of the amount at the time of the withdrawals to around $15,489,415.

Related: Dark Web Market AlphaBay Goes Down

Related: Study Finds Rampant Sale of SSL/TLS Certificates on Dark Web

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

Expert Insights

Related Content

Cybercrime

The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Cybercrime

A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Cybercrime

As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.

Cybercrime

Luxury retailer Neiman Marcus Group informed some customers last week that their online accounts had been breached by hackers.

Cybercrime

Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.

Cybercrime

Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.

Artificial Intelligence

The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.

Cybercrime

Satellite TV giant Dish Network confirmed that a recent outage was the result of a cyberattack and admitted that data was stolen.