DarkOwl Examines AlphaBay’s Return, Flags Possible Phishing Site
Summary
DarkOwl reviews AlphaBay’s 2021 relaunch, citing service instability, skeptical user reactions and signs that a surface-web lookalike may be phishing users. Analysts question the new market’s legitimacy but cannot confirm who runs it or whether it is a law-enforcement r
Key points
- DeSnake resurfaced in August 2021 to promote AlphaBay’s return, using a historical PGP key; the article does not establish that DeSnake is the original operator.
- The market’s Tor and I2P services were frequently unavailable, while DeSnake claimed 15,000 accounts, 450 vendors and more than 400 listings.
- DarkOwl found a surface-web lookalike with a Tor link absent from AlphaBay’s verified mirrors list and assessed it as likely intended to steal credentials.
- Analysts cited unusual registration requirements, extensive rules and FAQs, and the market’s promotion of I2P as anomalies, but not proof of who operates it.
- DarkOwl raised the possibility of a covert law-enforcement operation, noting that authorities seized the original market’s servers and Cazes’s laptop; it could not confirm that theory.
- The article notes that AlphaBay promoted I2P without discussing peer-discovery and de-anonymization risks that DarkOwl considered relevant.
Article Details
- Event Type
- Reported relaunch of the AlphaBay darknet marketplace in 2021, accompanied by reports of a suspected phishing site impersonating it and DDoS-related service disruptions.
- Impact
- DarkOwl reported that the revived market had frequent availability and registration problems and only a few hundred observed listings, while DeSnake claimed 15,000 accounts, 450 vendors, and more than 400 listings. DarkOwl said a surface-web domain likely directed users to a phishing site that could steal credentials, but did not disclose the domain. Dread and associated services were reportedly inaccessible during a period of heavy DDoS activity; the article does not establish who was responsible.