In DarkOwl’s Darknet Marketplace Snapshot blog sequence, our researchers provide brief-kind perception into a wide range of darknet marketplaces: looking for traits, exploring new marketplaces, examining admin and vendor activities, mega darknet marketmega darknet market and providing a host of insights into this transient and infrequently criminal corner of the internet. This version options OMG!OMG! market.

OMG!OMG! Market: An Intro

OMG!OMG! market is a large Russian-primarily based decentralized darknet marketplace that this year has been elevated as a ‘Premium Darknet Drug Market’ following Hydra’s seizure in April of 2022. Recently, DarkOwl has observed the market being mentioned more often in drug-commerce associated discussions and commercials on Russian boards. Lots of the vendors on OMG!OMG! had been energetic for years on Hydra, once once more showing that though a market is seized, the illicit commerce shifts elsewhere and continues.

To access the marketplace on the Tor network and look at vendor’s offerings, market guests must resolve a number and textual content-based mostly captcha.

Figure 1 OMG!OMG! Marketplace Landing Page (pre-authentication) Source: Tor Anonymous Browser

The landing page for the marketplace lists the daily trade rates for Bitcoin and affords the site in both English and Russian. Users may change the language of the positioning by clicking on the corresponding flag icons. The appear and feel of OMG!OMG! market may be very just like Hydra, with the market’s logo on the top left, search bar in the middle, and image-linked vendor retailers arranged in a desk on the principle page.

Figure 2 OMG!OMG! Marketplace Landing Page Source: Tor Anonymous Browser

Unique Characteristics of OMG!OMG! Marketplace

OMG!OMG! market shares characteristics that many other darknet marketplaces have; nonetheless, there are further unique qualities that make this market stand out.

Like most other marketplaces, Bitcoin is the one forex accepted and an ESCROW fee system is utilized. Users should have an account and cash deposited in their Bitcoin wallets available on the market to contact the administrators. The positioning claims it updates the conversion fee between Bitcoin and Rubles every quarter-hour. The marketplace doesn't listing the number of vendors or sellers. However, DarkOwl analysts famous that there are over 3,four hundred distributors advertising on the marketplace, however, not all of these retailers could also be active. Like some other darknet marketplaces, OMG!OMG! market has a discussion board related to the market. However, this part of the positioning provides the translated error message: "This part is under reconstruction."

For security and anonymity functions the market encourages all users to put in a PGP key and to make use of two-issue authentication for accounts.

Each vendor selling throughout the market displays the number of deals they've completed. Some distributors have a blue checkmark subsequent to their store nameas nicely, to indicate that they have been verified by the market’s administration. A selectable coronary heart button is accessible in each vendor store so that clients could "favorite" sure products.

What really sets OMG!OMG! marketplace apart is its distinctive ordering and supply mechanisms. Once a consumer places an order, the delivery is primarily set by location. A consumer is prompted to pick their location immediately when accessing the site’s landing web page - which is as odd for a darknet market that's designed to advertise anonymity. This location data allows for corresponding products and distributors with the identical location because the customer’s the option of "instant transactions." After a buyer sets their location within the marketplace, they will look for merchandise within the search bar which might be able to be delivered to them by sellers close by.

After clients pay, the vendors, or potentially their employed couriers, will physically conceal the purchase like a drop (referred by vendors as "treasure") across the customer’s geographic location. Finally, the client will receive coordinates and pictures to find and gather their purchases.

Figure 3 Regional Vendor Mapping from OMG!OMG! Market Source: Tor Anonymous Browser

There are three order choices: immediate, pre-order, and mail. An prompt order, as described above, will be collected by the client round their location proper after they pay on-line. For a pre-order, the shopper waits for confirmation from the seller until they transfer the merchandise to a specified drop location. This takes extra time however is customized and extra secure than instant. Mail orders must be confirmed by the vendor and shipped by the seller via publish or courier.

Figure 4 Regional Delivery Selection OMG!OMG! Market Source: Tor Anonymous Browser

There are additionally three completely different ways in which immediate delivery packages will likely be hidden to avoid attainable interception or theft. DarkOwl extracted the excerpt below from the OMG!OMG!’s FAQ page; the original content material was in Russian.

Editors notice: We decided "bookmark" as translated by Google Translate means "delivery."

"There are three kinds of bookmarks - prikop, cache, magnet.

Prikop - the packed items shall be buried shallowly in the ground (possibly within the snow in winter). Any such bookmark gives enough reliability from the invention of a treasure by an outsider, nevertheless it happens that it may be difficult to seek out such a treasure yourself.

Cache - a packaged merchandise is disguised as a third-social gathering merchandise and left in a secluded place or simply on the road. Such treasures are often quite simple to take away, the reliability of detection by strangers will be different and is dependent upon the masking.

Magnet - the packaged product is connected to a steel floor in a place inaccessible to a direct view. Usually such treasures are very straightforward to shoot, however there will not be very many reliable places for them."

OMG!OMG! marketplace’s instantaneous supply features are built for those customers solely residing in Russia, however distributors also ship internationally such as to the United States and Europe. The market advertises they assist customers in and recruits dealers from the nearby Commonwealth of Independent States (CIS) countries:

"We invite dealers from Kazakhstan and Belarus - now we have a major increase in clients from these nations."

OMG!OMG! Market: The Products

Drugs are by-far the most typical good offered for sale on OMG!OMG! market. The classes of drugs advertised include: cannabinoids, stimulants, euphoretics, psychedelics, dissociates, opioids, and pharmaceuticals.

In addition to medication, different widespread illicit items, akin to fraudulent documents, e.g. University diplomas, Russian passports, residence permits, driver’s licenses, letters from the inner Ministry of Affairs, and so on., are available in the marketplace. There does not seem like products such as weapons or listings which are human-associated. The "rules" portion of the market explains that outlets together with human trafficking or "renting" outlets usually are not allowed on the location.

DarkOwl analysts noticed digital items like financial institution accounts, Qiwi wallets, and SIMs for sale along with source code and software program, reminiscent of Telegram bots.

Figure 5 a fraudulent university diploma from OMG!OMG! supply: Tor Anonymous Browser

"Diplomas and certificates authentic workmanship, all levels of safety. Data for the structure:

1. Name2. Date of beginning and place of beginning3. Last place of examine (what and in what 12 months was completed, earlier than "entering" a college, technical college, school or vocational school)4. Full title of the academic establishment (which needs to be made)5. Specialty6. Years of study7. Type of research8. Approximate estimates (attainable as a percentage)9. Degree for universities (specialist, master or bachelor)10. Full title, handle, and telephone variety of the recipient (Required, this info is needed for the courier service to make supply)11. if there are any samples, then attach them tooStrictly on the factors on the structure, examine all the factors carefully. After its coordination and approval, the document goes into manufacturing, where it is going to be impossible to right errors! Manufactured and shipped inside 3 working days

More than 5 years in the marketplace! Over 150,000 trades on Hydra."

The translated advertisement above consists of the quantity of trades the vendor had on Hydra market to determine repute on OMG!OMG! The OMG!OMG! market administrator added a gentle blue banner by the seller’s title to indicate the variety of deals completed on OMG!OMG! for extra creditability. In this case, the vendor DARKOTIK has had amassed a number of thousand transactions (3,480 total). Most of the drug listings offer detailed info about the products.

Some embody direct quotes of buyers’ experiences:

Ecstasy users describe their inside state usually as euphoria, intimacy and closeness to other folks - "all individuals are my friends"; a feeling of "flying, endless happiness, excessive sensitivity."

Users who buy merchandise can present suggestions ratings on quality, delivery, and service on a scale from 1-5 to additional set up vendor credibility. The veracity of the information posted is unclear and could easily be falsified.

Figure 6: Diamond product overview OMG!OMG! Market supply: Tor Anonymous Browser

Some vendors with drug listings have an additional info button next to the product itemizing. Following this link provides in-depth data for estimated dosage, preparation strategies, and description and duration of the product’s effects.

Another class not frequent with other darknet decentralized marketplaces is job opportunities. This part includes choices to apply for commercialized drug distribution supporting roles corresponding to: Pawnbroker, Stock, Carrier, Manager, Chemist, and Grower.

Figure 7: work alternative listings on OMG!OMG! Market Source: Tor Anonymous Browser

Below is a translated description for a job itemizing marketed on OMG!OMG market:

We are glad to welcome you to "Black Star Mafia", the quickest rising shop on the site! As a result of current events, many people have misplaced our jobs and, consequently, our technique of subsistence.Experience shouldn't be required, we teach from A to Z all the subtleties of conducting shadow actions for your successful and safe growth, a supervisor is assigned to you, somebody who will information you by the hand to the outcome throughout all the journey, and will aid you at a tough moment to lighten your burden, scale back all the difficulties are gone.

For communication, write to us within the PM of the shop, we reply around the clock!"

These work ads are likely to keep up with the premise of the marketplace that they will ship directly to you in case you are in Moscow.

OMG!OMG! Market: Across the Darknet

OMG!OMG! has been advertised extensively on different common Russian darknet boards and markets, like Rutor. Most of the distributors energetic on the marketplace transact across a number of darknet markets including Alphabay, Nemesis, and Narnia.

Figure 8: OMG!OMG! Market on Rutor Source: DarkOwl Vision

DarkOwl has not identified any practical mirrors of the location. The site itself claims that "any different sites, initiatives, mirrors, and so on. have nothing to do with us and are scammers." A number of the distributors current on OMG!OMG! market have constructed out their skilled operations throughout the darknet.

One vendor, often called Black Star Mafia, seems to have been involved in drug sales on the darknet for years. They've also been mentioned on Wayaway. A put up crawled by DarkOwl Vision in 2018 identified Black Star Mafia in a forum promoting amphetamines in a discussion thread additionally mentioning coordinates, much like how instant transactions work on OMG!OMG!

Another publish, crawled by Vision in 2019 from an onion site, additionally identifies Black Star Mafia as a drug seller and promotes the professionalism and experience of their hoarders. In this occasion they're responding to a dispute over a product order and are outlining the requirements crucial for the dispute.

The administration of OMG!OMG! market is designed to moderate and intervene if there is a dispute between vendors and prospects. The foundations section of the site details that the names of Administration accounts are highlighted in pink.

The usage of PGP keys and 2FA talked about earlier may in some unspecified time in the future could have triggered difficulties for the distributors. Posts crawled by DarkOwl Vision element distributors having points with enrollment, having funds correctly credited to accounts, and 2FA. A string of posts in a discussion thread sees multiple distributors on OMG!OMG! market describing points they're having available on the market, with a few of them commenting at "WD" to intervene. After a number of distributors mentioned issues they had been having with 2FA and enrollment on OMG!OMG! one commenter wrote:

"WD Don’t you suppose it’s a seam undertaking and nothing extra? Solve the issue in coordination with this site. How many people will undergo before you make the right resolution?"

There was additionally some doubt cast on whether the admin of OMG!OMG! still had control over their account and access to the PGP key. Someone repeatedly brought up points with 2FA and the market admin responded that it was temporarily out of order and would be fixed soon. After issues were not resolved, vendors questioned in the event that they still had access to their accounts. A self-figuring out OMG!OMG! admin responded that they had been nonetheless in command of their PGP key and promised to replace the canary within 60 days and supplied the latest Bitcoin hash. Later, another person in the thread identified that the admin was very behind with their promised updates.

"With this message, the location admin confirms that every little thing is okay with him, he didn't fuck up his PGP key, and undertakes to replace this message inside 60 days. Only the date in the message 2021-07-thirteen is July 13, 2021, that's, this message was left 9 months in the past, and already overdue by 7 months.

Either the admin is now not an admin, or he blew the key, or simply forgot - in any case, these are critical arguments towards the positioning - and for my part an official remark is critical.

Are you pretending not to notice once more?"

While researching and penning this piece DarkOwl analysts noticed multiple days the place the site was unavailable, which is likely a continuation of the final trend of widespread DDoS assaults in opposition to the Tor network. With Hydra out of the way in which, OMG!OMG! market may very well be poised for achievement or focused to regulation enforcement intervention. A few of Hydra’s previous vendors appear to have made the migration to OMG!OMG!. However, the extra successful a darknet marketplace grows, the bigger of a target it could actually turn out to be to law enforcement efforts.