Illegal goods for sale on dark web markets see boost after death of AlphaBay and Hansa

Vendors who sell drugs, weapons and hacked databases on the dark web are flocking to alternative services after two of the biggest underground marketplaces – Alphabay and Hansa – were taken offline in a global cybercrime operation last month, research suggests.

While sales of illicit goods and services appear to have reduced since the two leading markets were shuttered, listings on some websites increased by nearly 30%, according to fresh research carried out by Israeli cybersecurity firm Cyberint and commissioned by the BBC.

On 20 July, a takedown operation spearheaded by US and Dutch police forces seized the dark web-hosted markets and made numerous arrests.

To judge the effect it had on the dark web, Cyberint analysed what changes had occurred on other underground services between 24-31 July.

It found a website known as Dream Market is now the largest store left standing – boasting more than 98,800 listings, rising by more than 3,000 over the week.

Listings on TradeRoute, which specialises in alcohol and tobacco, rose to 17,816 from 14,914.

Two other stores, Tochka and WallSteetMarket, had listings increase by more than 20% each. The BBC reported that only one experienced lacklustre performance. A weapon-selling service, called RsClub Market, had listings drop by 37.8% – likely due to increased fear of police action.

On a number of internet forums, speculation has steadily mounted that law enforcement is now working to infiltrate other dark web marketplaces. The next target for cyber police investigators is likely to be Dream Market – the current king of the internet's criminal underbelly.

In a haze of paranoia, some claim it's already compromised.

"I got contacted by an ex-Hansa staff member telling me that the operation is apparently bigger than we currently assume, that 'there will be a bloodbath, a purge' and that 'any vendor [should] seize his operation, lawyer up and hide his trails," one post on Reddit's r/darkwebmarkets read.

Speculation remains unverified at the time of writing.

AlphaBay's alleged founder and administrator, a 25-year-old Canadian citizen called Alexandre Cazes, was detained in Thailand on 5 July and later took his own life while in custody.

At roughly the same time, Dutch police took control of the Hansa servers and managed it for a month, collecting thousands of vendor and customer details. According to authorities, the delivery addresses for a large number of dark web orders were later passed directly to Europol.

Europol's director Rob Wainwright promised "there are more of these operations to come".

Elad Ben-Meir, a marketing chief at Cyberint, told the BBC: "There is growing evidence that when one illegal dark web marketplace is closed, the illicit business quickly starts to be redirected.

"However, there is also evidence that continuing crackdowns by international law enforcement operations, are having the effect of forcing illicit traders away from those sites selling firearms or child pornography."

"There is some interesting buzz around Dream Market potentially being compromised and/or under law enforcement control, which is feeding fear and uncertainty amongst vendors and buyers.

"That is probably why Dream Market has not grown substantially in the wake of the takedowns."