OP 13 September, 2019 - 02:13 PM
Phishing is the fraudulent attempt to obtain sensitive information such as usernames, passwords and Pin details by disguising oneself as a trustworthy entity.
These days phishing attacks are becoming more widespread. One of the primary reasons is because of easy access to cyber crime kits more and more people are entering in this phishing game.
Dark web used to be a place for experienced tech savvy criminals But now as the dark web has gone main stream due to the coverage by mainstream media, lots and lots of regular buyers are joining the dark web markets. This trend has made clever scammers to focus on these non experienced dark web users targeting them with phishing attacks using fake market clones. This method has become very successful and made these scammers millions of dollars without doing any hard work.
To deter the menace of phishing, Dark web markets tried different methods but it has very small effect to stop these attacks. More and more people are becoming the target of these scams and they don’t seem to be slowing down.
Coming to the Point, for weeks we have been getting lots of emails about an ongoing phishing scam targeting users of Empire Market. We were also seeing lots of comments on our empire market’s page about users getting phished and losing thousands of dollars.
The Investigation
The situation was very bad. Users were complaining that we should remove Empire Market from our site. We knew that the market wasn’t involved because it didn’t make any sense because when you are already earning so much money from your business then you don’t need these kind of cheap tactics to make some extra bucks on the side.
Anyway something needed to be done. John Marsh sent me an email and requested me to do some research about the situation so that we can come up with some sort of defense against it or atleast advise our users about it.
So i carefully analyzed all the emails and comments, did some research on other forums as well and came to the conclusion that all of the users that claimed they got phished had one thing in common which was they all got their links from dark.fail.
The target was set. I knew when so many users were saying that they got their links from dark fail then there must be something wrong with this site.
The task wasn’t easy but i knew i had to do it no matter what happens. I sat down in front of my pc, open tor browser and started refreshing darkfail website. As soon as i saw a new link i opened it in my tor browser to see if it was legit or a phishing url. Six hours passed by and i got nothing, 7 hours, 8 hours, 9, 10, 11 hours passed by and nothing showed. I was starting to get disappointed.
After the 12th hour, i was tired and about to end my work shift, i got my first breakthrough.
The Proof
After a 12 hour long wait i got what i wanted, it was time to get the proof before these links disappear again. I quickly took screenshots of the phishing links and their phishing pages. But i knew only screenshot proof will be useless unless there was some undeniable way of recording this scam.
Without wasting a moment i knew what i had to do. I grabbed my camera and started recording all this in a single shot. I know scammers are well talkers and will deny all this by saying that these screenshots are fake etc etc. I wanted to make sure there is no way for them to deny what they are doing and to prove general public that they should stay miles away from these scammers.
dark.fail Note the link in red circle
![[Image: xbJhpJ9.png]](https://i.imgur.com/xbJhpJ9.png)
Note the link in the red circle. Now we will open this link in our browser to see where it takes us.
![[Image: g9hq0BP.png]](https://i.imgur.com/g9hq0BP.png)
It took us to empire market’s main page where its not showing link inside captcha image. Now we will go to empire’s registration page.
![[Image: mpfFh9E.png]](https://i.imgur.com/mpfFh9E.png)
Again no link shows up inside captcha image. Now we will go to a real phishing website that is spreading phishing links of various markets. Its called darkfail.org. It is ranked just under real dark.fail on google.
![[Image: jfTG05P.png]](https://i.imgur.com/jfTG05P.png)
Watch the full video on the CLEARNET
https://www.darknetstats.com/caught-red-handed-dark-fail-spreading-phishing-links-with-undeniable-full-video-proof/
These days phishing attacks are becoming more widespread. One of the primary reasons is because of easy access to cyber crime kits more and more people are entering in this phishing game.
Dark web used to be a place for experienced tech savvy criminals But now as the dark web has gone main stream due to the coverage by mainstream media, lots and lots of regular buyers are joining the dark web markets. This trend has made clever scammers to focus on these non experienced dark web users targeting them with phishing attacks using fake market clones. This method has become very successful and made these scammers millions of dollars without doing any hard work.
To deter the menace of phishing, Dark web markets tried different methods but it has very small effect to stop these attacks. More and more people are becoming the target of these scams and they don’t seem to be slowing down.
Coming to the Point, for weeks we have been getting lots of emails about an ongoing phishing scam targeting users of Empire Market. We were also seeing lots of comments on our empire market’s page about users getting phished and losing thousands of dollars.
The Investigation
The situation was very bad. Users were complaining that we should remove Empire Market from our site. We knew that the market wasn’t involved because it didn’t make any sense because when you are already earning so much money from your business then you don’t need these kind of cheap tactics to make some extra bucks on the side.
Anyway something needed to be done. John Marsh sent me an email and requested me to do some research about the situation so that we can come up with some sort of defense against it or atleast advise our users about it.
So i carefully analyzed all the emails and comments, did some research on other forums as well and came to the conclusion that all of the users that claimed they got phished had one thing in common which was they all got their links from dark.fail.
The target was set. I knew when so many users were saying that they got their links from dark fail then there must be something wrong with this site.
The task wasn’t easy but i knew i had to do it no matter what happens. I sat down in front of my pc, open tor browser and started refreshing darkfail website. As soon as i saw a new link i opened it in my tor browser to see if it was legit or a phishing url. Six hours passed by and i got nothing, 7 hours, 8 hours, 9, 10, 11 hours passed by and nothing showed. I was starting to get disappointed.
After the 12th hour, i was tired and about to end my work shift, i got my first breakthrough.
The Proof
After a 12 hour long wait i got what i wanted, it was time to get the proof before these links disappear again. I quickly took screenshots of the phishing links and their phishing pages. But i knew only screenshot proof will be useless unless there was some undeniable way of recording this scam.
Without wasting a moment i knew what i had to do. I grabbed my camera and started recording all this in a single shot. I know scammers are well talkers and will deny all this by saying that these screenshots are fake etc etc. I wanted to make sure there is no way for them to deny what they are doing and to prove general public that they should stay miles away from these scammers.
dark.fail Note the link in red circle
Note the link in the red circle. Now we will open this link in our browser to see where it takes us.
It took us to empire market’s main page where its not showing link inside captcha image. Now we will go to empire’s registration page.
Again no link shows up inside captcha image. Now we will go to a real phishing website that is spreading phishing links of various markets. Its called darkfail.org. It is ranked just under real dark.fail on google.
Watch the full video on the CLEARNET
https://www.darknetstats.com/caught-red-handed-dark-fail-spreading-phishing-links-with-undeniable-full-video-proof/