Skip to main content

Dark ending: what happens when a dark web market closes down

Wang, Yichao, Arief, Budi, Hernandez-Castro, Julio C. (2023) Dark ending: what happens when a dark web market closes down. In: In Proceedings of the 9th International Conference on Information Systems Security and Privacy. . ISBN 978-989-758-624-8. (doi:10.5220/0011681600003405) (KAR id:100540)

PDF Author's Accepted Manuscript
Language: English

Download (523kB) Preview
[thumbnail of ICISSP_2023_62_CR.pdf]
This file may not be suitable for users of assistive technology.
Request an accessible format
Official URL:


As the economic hubs of (potentially) illegal transactions, dark web markets are fraught with uncertainty, including their ending. The ending of a dark web market can bring disruption to the stakeholders involved, especially vendors and buyers. Most importantly, there is a growing concern that such an ending can cause financial repercussions or even fraud victimisation. At the moment, there is scant published work about how, why or when dark web markets would end. We aim to fill this gap to help the academic and security research communities to reflect on what would typically happen to dark web markets in their final days. We used crawling and data scraping techniques to gather relevant weekly data from six dark web markets over a span of several months, right up to their closure. We then analysed the data to find common characteristics and predictive features leading to the closure of these markets. We found three main reasons for the ending of dark web markets: (i) exit scam, (ii) voluntary closure, or (iii) taken down by Law Enforcement Agencies (LEAs). We also gained further insights by analysing our data more closely. For instance, markets are most likely to be closed down when they are most visible, when they are under attack or when they are growing rapidly to their peak. In particular, more mature markets (i.e. markets that have been in operation for a long period of time) are more likely to disappear when their economic patterns start to change (for example, there might be a rapid growth or a sudden – or even gradual, but noticeable – economic decline). When a market was closed down, vendors and buyers would typically move on quickly to other alternative markets – which might grow rapidly as a result – and in turn, those alternative markets’ risk of being closed down would become higher. Whether a market is still accepting new vendors (or not) appears to be a valuable indicator for predicting the market’s next move. These insights can be useful in anticipating potential market closure, so that sufficient warning can be provided to avoid people being victimised.

Item Type: Conference or workshop item (Paper)
DOI/Identification number: 10.5220/0011681600003405
Uncontrolled keywords: Cybercrime; dark web; anonymous online markets; data collection; rug pull; exit scam; closing-down; take-down
Subjects: Q Science > QA Mathematics (inc Computing science) > QA 76 Software, computer programming,
Divisions: Divisions > Division of Computing, Engineering and Mathematical Sciences > School of Computing
University-wide institutes > Institute of Cyber Security for Society
Depositing User: Yichao Wang
Date Deposited: 20 Mar 2023 11:51 UTC
Last Modified: 21 Mar 2023 14:56 UTC
Resource URI: (The current URI for this page, for reference purposes)
Wang, Yichao:
Arief, Budi:
Hernandez-Castro, Julio C.:
  • Depositors only (login required):


Downloads per month over past year