Security Experts:

Connect with us

Hi, what are you looking for?



Authorities Arrest Administrators of Portal to Dark Web Marketplaces

Two Israeli citizens arrested this week are accused of being the administrators of a website that linked to numerous illegal dark web marketplaces. 

Two Israeli citizens arrested this week are accused of being the administrators of a website that linked to numerous illegal dark web marketplaces. 

Arrested on May 6 in France and Israel, the two are charged with receiving millions of dollars in kickbacks for purchases of illegal goods by individuals referred to dark web marketplaces by their website, DeepDotWeb.

The two had allegedly owned and operated DeepDotWeb since 2013, providing users with direct access to numerous illegal marketplaces where illegal drugs, firearms, malicious software, were being traded, along with hacking tools, stolen financial information and payment cards and other illegal goods. 

Now seized by court order, the website, which is hosted at www.deepdotweb(.)com and also accessible on the Darknet at DeepDot35Wveyd5(.)onion, is estimated to have referred hundreds of thousands of users to dark web marketplaces.

The two, Tal Prihar, 37, an Israeli citizen residing in Brazil, and Michael Phan, 34, an Israeli citizen residing in Israel, were indicted on April 24, 2019. 

According to an indictment unsealed by the U.S. Department of Justice, Prihar and Phan received kickback payments representing commissions on the proceeds from the purchases that individuals made on the dark web marketplaces they were referred to via DeepDotWeb. 

The kickback payments were made in Bitcoin and total over $15 million, the indictment says. To conceal the nature and source of the illegal proceeds, the two transferred the money to other Bitcoin accounts, as well as to bank accounts they controlled in the names of shell companies.

Given that the dark web marketplaces operated on the TOR network, users looking to access them needed to know their exact .onion addresses. DeepDotWeb made it easy for users to access those portals by including pages of hyperlinks to various dark net marketplaces’ .onion addresses.

The links included unique account identifiers, so that the individual marketplaces could pay “Referral Bonuses,” to DeepDotWeb. The referral bonuses represented a percentage of the profits of the activities conducted on the marketplace by individuals using these customized referral links. 

Dark web marketplaces accessed using these links included AlphaBay Market, Agora Market, Abraxas Market, Dream Market, Valhalla Market, Hansa Market, TradeRoute Market, Dr. D’s, Wall Street Market, and Tochka Market. 

Nearly a quarter of the orders completed on AlphaBay, one of the largest illegal marketplaces when seized in 2017, were associated with an account created through a DeepDotWeb referral link. Thus, Prihar and Phan received a referral fee for nearly a quarter of all orders made on AlphaBay.

Prihar was the administrator of DeepDotWeb (he registered the domain, made infrastructure payments and maintained control over site content), while Phan was responsible for technical operations (maintaining the website’s day-to-day operation). 

The two received approximately 8,155 Bitcoin in kickback payments from dark net marketplaces, worth around $8,414,173 at the time of each transaction. The virtual currency’s fluctuating exchange rate, however, increased the value of the amount at the time of the withdrawals to around $15,489,415.

Related: Dark Web Market AlphaBay Goes Down

Related: Study Finds Rampant Sale of SSL/TLS Certificates on Dark Web

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Expert Insights

Related Content


Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.


The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.


The FBI dismantled the network of the prolific Hive ransomware gang and seized infrastructure in Los Angeles that was used for the operation.


A new study by McAfee and the Center for Strategic and International Studies (CSIS) named a staggering figure as the true annual cost of...


CISA, NSA, and MS-ISAC issued an alert on the malicious use of RMM software to steal money from bank accounts.


Video games developer Riot Games says source code was stolen from its development environment in a ransomware attack

Application Security

PayPal is alerting roughly 35,000 individuals that their accounts have been targeted in a credential stuffing campaign.


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...