Hansa (market)

Last updated
Hansa Market
Logo of Hansa market.png
Type of site
Darknet market
Available in English
URLhansamkt2rr6nfg3.onion (defunct) [1]
CommercialYes
RegistrationRequired
Current statusOffline

Hansa was an online darknet market which operated on a hidden service of the Tor network.

Contents

On July 20, 2017, it was revealed that it had been compromised by law enforcement for several weeks before closing shortly following AlphaBay as a culmination of multinational law enforcement cooperation in Operation Bayonet. [2] [3]

Compromise and Seizure

See Operation Bayonet (darknet) for the full details on the investigation and seizure of the website.
Dutch police discovered the true location in 2016. [4] Law enforcement quickly began monitoring all actions on the site. Administrators soon moved the site to another unknown host, but law enforcement got another break in April 2017, which allowed them to identify the new hosting company, in Lithuania.

On June 20, 2017, German police arrested the administrators (two German men) and the Dutch police were able to take complete control of the site and to impersonate the administrators. The following changes were made to the Hansa website to learn about careless users:

Shutdown

When AlphaBay was shut down on July 4, the expected flood of users came to Hansa, until Hansa's shutdown on July 19/20. During this time, the Hansa userbase (grew from 1000 to 8000 vendors per day [3] ). Law enforcement allowed the userbase to grow during the seizure resulting in 27000 illegal transactions occurring which served as evidence for future prosecution of the users. [4] [7] Local cybercrime prosecutor Martijn Egberts claimed to have obtained around 10,000 addresses of Hansa buyers outside of the Netherlands. [8]

After shut down, the site displayed a seizure notice and directed users to their hidden service [9] to find more information about the operation.

Related Research Articles

<span class="mw-page-title-main">Cybercrime</span> Type of crime based in computer networks

Cybercrime encompasses a wide range of criminal activities that are carried out using digital devices and/or networks. These crimes involve the use of technology to commit fraud, identity theft, data breaches, computer viruses, scams, and expanded upon in other malicious acts. Cybercriminals exploit vulnerabilities in computer systems and networks to gain unauthorized access, steal sensitive information, disrupt services, and cause financial or reputational harm to individuals, organizations, and governments.

Operation Bayonet may refer to:

The dark web is the World Wide Web content that exists on darknets: overlay networks that use the Internet but require specific software, configurations, or authorization to access. Through the dark web, private computer networks can communicate and conduct business anonymously without divulging identifying information, such as a user's location. The dark web forms a small part of the deep web, the part of the web not indexed by web search engines, although sometimes the term deep web is mistakenly used to refer specifically to the dark web.

<span class="mw-page-title-main">Operation Onymous</span> International police operation targeting darknet markets

Operation Onymous was an international law enforcement operation targeting darknet markets and other hidden services operating on the Tor network.

Agora was a darknet market operating in the Tor network, launched in 2013 and shut down in August 2015.

<span class="mw-page-title-main">Evolution (marketplace)</span> Former darknet market

Evolution was a darknet market operating on the Tor network. The site was founded by an individual known as 'Verto' who also founded the now defunct Tor Carding Forum. Evolution was active between 14 January 2014 and mid March 2015.

<span class="mw-page-title-main">AlphaBay</span> Defunct darknet marketplace

AlphaBay was a darknet market operating at different times between September 2014 and February 2023. At times, it was both an onion service on the Tor network and an I2P node on I2P. After it was shut down in July 2017 following law enforcement action in the United States, Canada, and Thailand as part of Operation Bayonet, it was relaunched in August 2021 by the self-described co-founder and security administrator DeSnake. The alleged original founder, Alexandre Cazes, a Canadian citizen born on 19 October 1991, was found dead in his cell in Thailand several days after his arrest, with police suspecting suicide.

A darknet market is a commercial website on the dark web that operates via darknets such as Tor and I2P. They function primarily as black markets, selling or brokering transactions involving drugs, cyber-arms, weapons, counterfeit currency, stolen credit card details, forged documents, unlicensed pharmaceuticals, steroids, and other illicit goods as well as the sale of legal products. In December 2014, a study by Gareth Owen from the University of Portsmouth suggested the second most popular sites on Tor were darknet markets.

DeepDotWeb was a news site dedicated to events in and surrounding the dark web featuring interviews and reviews about darknet markets, Tor hidden services, privacy, bitcoin, and related news. The website was seized on May 7, 2019, during an investigation into the owners' affiliate marketing model, in which they received money for posting links to certain darknet markets, and for which they were charged with conspiracy to commit money laundering. In March 2021 site administrator Tal Prihar pleaded guilty to his charge of conspiracy to commit money laundering.

Grams is a discontinued search engine for Tor based darknet markets launched in April 2014, and closed in December 2017. The service allowed users to search multiple darknet markets for products like drugs and guns from a simple search interface, and also provided the capability for its users to hide their transactions through its bitcoin tumbler Helix.

The Russian Anonymous Marketplace or RAMP was a Russian language forum with users selling a variety of drugs on the Dark Web.

<span class="mw-page-title-main">Carding (fraud)</span> Crime involving the trafficking of credit card data

Carding is a term describing the trafficking and unauthorized use of credit cards. The stolen credit cards or credit card numbers are then used to buy prepaid gift cards to cover up the tracks. Activities also encompass exploitation of personal data, and money laundering techniques. Modern carding sites have been described as full-service commercial entities.

Operation Bayonet was a multinational law enforcement operation culminating in 2017 targeting the AlphaBay and Hansa darknet markets. Many other darknet markets were also shut down.

<span class="mw-page-title-main">Dream Market</span> Online black market

Dream Market was an online darknet market founded in late 2013. Dream Market operated on a hidden service of the Tor network, allowing online users to browse anonymously and securely while avoiding potential monitoring of traffic. The marketplace sold a variety of content, including drugs, stolen data, and counterfeit consumer goods, all using cryptocurrency. Dream provided an escrow service, with disputes handled by staff. The market also had accompanying forums, hosted on a different URL, where buyers, vendors, and other members of the community could interact. It is one of the longest running darknet markets.

<span class="mw-page-title-main">Dread (forum)</span> Online discussion forum hosted on the dark web

Dread is a Reddit-like dark web discussion forum featuring news and discussions around darknet markets. The site's administrators go by the alias of Paris and HugBunter.

Boystown was a child pornography website run through the Tor network as a hidden service.

Hydra was a Russian language dark web marketplace, founded in 2015, that facilitated trafficking of illegal drugs, financial services including cryptocurrency tumbling for money laundering, exchange services between cryptocurrency and Russian rubles, and the sale of falsified documents and hacking services. On April 5, 2022, American and German federal government law enforcement agencies announced the seizure of the website's Germany-based servers and cryptocurrency assets. Before its closure, it had been the longest-running dark web marketplace. The United States Department of Justice has indicted one Russian man for his role in running the servers for the website.

Operation Dark HunTOR was an international law enforcement operation targeting opioid trafficking and other illegal activities on The Onion Router (TOR). The operation, which was conducted across the United States, Australia, and Europe, over a period of 10 months. In addition Europol released a statement that said the operation was composed of a series of separate but complementary actions in Australia, Bulgaria, France, Germany, Italy, the Netherlands, Switzerland, the United Kingdom and the United States, with coordination efforts led by Europol and Eurojust; which greatly expands on the initial number of countries that the US press releases indicated.

Operation SpecTor was an operation coordinated by Europol, which involved nine countries, including the United States, Austria, France, Germany, and the Netherlands to disrupt fentanyl and opioid distribution. The operation targeted and took down the darknet market "Monopoly Market."

<span class="mw-page-title-main">White House Market</span> Defunct darknet marketplace

White House Market (WHM) was a darknet market that operated intermittently from August 24, 2019, to October 2, 2021. Launched in August 2019 and exclusively accessible through the Tor network, WHM garnered a significant user base with almost 895,000 registered users, 3,450 vendors, and nearly 47,500 listings, according to its home page. While the marketplace featured various illegal products, its main focus was on narcotics, particularly in European territories. WHM gained prominence by filling the void left by the closure of other darknet markets, such as Dream Market and Empire Market, in mid-2019. It distinguished itself through operational security measures, including mandatory JavaScript disabling and an effective moderation team that mediated disputes between users.

References

  1. "Deep Dot Web - Hansa". Archived from the original on 2015-08-12.
  2. "Massive blow to criminal Dark Web activities after globally coordinated operation". 20 July 2017. Retrieved 20 July 2017.
  3. 1 2 "Underground Hansa Market taken over and shut down". Politie (Dutch Police). 20 July 2017. Archived from the original on 21 July 2017. Retrieved 21 July 2017.
  4. 1 2 3 4 5 6 7 8 "Operation Bayonet: Inside the Sting That Hijacked an Entire Dark Web Drug Market". Wired. 2018-03-08.
  5. Cox, Joseph (August 25, 2017). "This Is How Cops Trick Dark-Web Criminals Into Unmasking Themselves". The Daily Beast .
  6. pxx51092 (July 25, 2017). "DON'T open the xlsx locktime file, beacon image confirmed in it with Hansa's server IP address". reddit. Archived from the original on October 9, 2017.{{cite news}}: CS1 maint: numeric names: authors list (link)
  7. Riggs, Mike (2017-07-26). "Five Lessons from the Hansa and AlphaBay Busts". Reason Hit&Run. Retrieved 2017-07-26.
  8. Satter, Raphael; Bajak, Frank (2017-07-21). "Dutch 'darknet' drug marketplace shut down". Portland Press Herald. Retrieved 2017-07-22.
  9. DeepDotWeb (31 October 2016). "Dutch National Prosecution Service and police launch Hidden Service in global Darknet enforcement operation". Archived from the original on 1 November 2016. Retrieved 26 July 2017.