Dark Web Chronicles, Volume 2: Exit Scams and Mysterious Disappearances

Darknet Chronicles, Volume 2: Exit Scams and Mysterious Disappearances

In this advisory series, the Alpha Team will explore various parts of "the dark web" that are rarely discussed or known in the security research community. The goal is to showcase peculiarities or stories of the dark web, demystifying the medium as well as giving valuable insight to our customers. This post discusses dark web marketplace exit scams, spam attacks, and the unusual downtime of a dark web social media platform, Dread.

Recommendations

• Continue monitoring the Alpha Team Tab for reports related to dark web activity, such as this one
• If you are interested in further insight, reach out to [email protected] for assistance

Details

Dark web marketplaces operate at a high level of flux. New sites pop up as quickly as others go down - either because the owners have scammed users, law enforcement has gotten involved, or some other situation. DDoS and spam attacks are common against dark web sites. Often, the attackers responsible attempt to extort funds from the sites they target, and threaten not to stop until their demands are met.

Somewhat similarly, exit scams are also relatively common. Dark Web Marketplaces generally have cryptocurrency wallets that receive all incoming payments from buyers, and then route them to seller wallets. These are called escrow wallets, and this is done to decrease chances of a buyer or seller's identify beinng revealed. This also serves to protect buyers, as funds generally sit in this wallet until the buyer receives the goods they have purchased. This does, however, mean that site admins have access to and control all funds flowing through the site. In some cases, site admins choose to "exit scam" with these funds. After a period of time where the site operates as it claims, and sellers recive the funds they are entitled to (which builds a credible reputation for the site), site admins suddenly cease routing payments out of the escrow wallet. This obviously burns the reputation of the marketplace, but site admins have already run away with huge amounts of cryptocurrency. In fact, when Wall Street Market exit scammed, the sites admins sought to gain nearly $12 million USD. This particular exit scam failed, as the site was under investigation by law enforcement, however may other exit scams have been very successful and have made site admins millions. Generally, when dark web marketplaces go down or are unresponsive suddenly, user begin to fear they are being exit scammed.

Although not a marketplace, dark web Reddit clone Dread went down suddenly this week. Predominantly used for buying drugs, reviewing drug sellers, and discussing topics related to dark web market places, the site is run by a user who goes by the handle HugBunter.

Figure 1. Front page of Dread, as of October 3, 2019.

The site initially went down September 18, 2019, for what was supposed to be planned routine maintenance. However, after 5 days, HugBunter posted only that he was sorry for the confusion and downtime. On September 27, 2019, after an additional 5 days of noncommunication,HugBunter's deadman switch was activated.

Figure 2. Deadman's switch message, posted after 10 days of downtime.

The flipping of the switch means that if the site is not restored to functionality within a week, all site contents will be wiped. Finally, however, on Sept. 30, Hugbunter confirmed he was alive and that he was who he said he was. The site's co-admin, Paris confirmed that HugBunter had proven his identity in three separate ways. Finally, on October 1, the site was restored.

The entirety of this situation was highly unusual. Hugbunter has not provided any explanation for his prolonged absence. The site has been victim of huge waves of spam attacks since its restoration, which was actually the initial reason for the downtime. With such little information out there on Dread's downtime, one can only speculate as to why.