Darknet Marketplace Snapshot Series: Ares Market

August 06, 2024

In DarkOwl’s Darknet Marketplace Snapshot blog series, our researchers provide short-form insight into a variety of darknet marketplaces: looking for trends, exploring new marketplaces, examining admin and vendor activities, and offering a host of insights into this transient and often criminal corner of the internet. This edition features Ares market.

Don’t forget to subscribe to our blog at the bottom of this page to be notified as new blogs are published.

Dark web marketplaces are synonymous with the dark web where users can buy and sell illicit goods. It began with Farm Market, followed by the more prolific Silk Road. Ever since Silk Road was taken down by law enforcement, different markets have jostled for supremacy. As such, dark web markets are perhaps one of the more recognized things to appear on the dark web and they operate just like surface web marketplaces with reviews, escrow services and reputations.

However, in recent years law enforcement have become more and more successful at shutting down these marketplaces, meaning that the vendors have to move to new areas. There have also been a number of exit scams from marketplaces with the admins closing down the site and taking the funds in escrow.

DarkOwl analysts will write a series of blogs reviewing the most popular marketplaces of today after recent seizures of once popular markets like Kingdom, Incognito, and Bohemia Marketplaces. We will explore the various sorts of products regularly sold and well as how much the prices of products can vary within or between product categories.

Ares Market

The first market we will explore is Ares Marketplace. Originally established in 2021, it is a well-known marketplace that offers a variety of products, from illicit substances and pharmaceutical substances to digital fraud products ranging from credit card fraud, cryptocurrency fraud, malware source code as well as a robust variety of counterfeit products like currency and IDs. Below is a screenshot of the homepage, which is what one would see after a successful log in:

Figures 1 and 2: Ares Market Home Page

Drugs 

Cocaine and ketamine seem to be the most popular drug products boasting over 1600 listings. Pricing varies considerably listing by listing and vendor by vendor. It’s a challenge to determine which vendors might be legitimate or which vendors could be scammers. Although vendors work on the principle of reputation, and purchasers will quickly leave reviews if they think something is a scam. DarkOwl analysts regularly see ketamine sold by the gram on Ares Market with prices varying drastically: 26 USD for 1 gram all the way to 482 USD for 25 grams:

Figure 3: Ketamine for sale on Ares Market

As stated above, reputation is very important for dark web market vendors. The vendors will have profiles on the markets which provide details of how long they have been on the site, how many successful sales they have had and details of the reviews they have received. The below screenshot shows a product listing from a vendor who seemingly has a high reputation, has been a member since 2021, and allegedly has successfully completed 216 sales:

Figure 4: Profile of Ketamine seller on Ares Market

Financial Fraud

Credit card fraud, aka carding, is also a popular product category on Ares with well over 500 listings. Again, prices range dramatically as well as the types of products offered.

 While Visa, Mastercard, and Amex tend to be the most popular credit card company targets on this site, it is also common to see Credit Unions (CUs) because threat actors consider CUs to be easy targets with the assumption that they don’t always have the same budget to combat fraud. The below screenshot is a good example of a well-known carding threat actor, johnnywalker1, selling bank accounts with active balances from Robins Credit Union, which is a Georgia based credit union. The user is selling these accounts for roughly 136 USD and allegedly will gain full access to an account with an active balance ranging from 3 – 5,000 USD in addition to relevant personal identifiable information (PII) to access the account online: credentials, SSN, DOB, address, etc.

Figure 5: Credit Union Credit cards for sale

 Johnnywalker also regularly sells accounts and cards affiliated with larger banking/credit card companies like Amex. This user is allegedly selling one American Express account for roughly 13.50 USD, which is significantly cheaper than the above example of the credit union:

Figure 6: American Express Credit Card for sale

The seller does not make clear how they are obtaining these cards, but threat actors are known to clone cards, or access banking information from stole credentials, particularly through Stealer Logs.

Counterfeiting

Counterfeiting is also a popular section on Ares Market. The two most popular product categories are counterfeit currency follower by counterfeit IDs.

 The below examples are from the currency category. The user, CounterKing, seems to have a verified reputation of 5 stars, level 9, and over 120 sales since they first registered in March 2023.

CounterKing is selling 20,000 Euros of counterfeit currency for roughly 2,284 USD. The post goes into excruciating detail of the product description as well as their Terms & Conditions. Counterfeit cash products are expensive, and it is common to see a price range anywhere from 300 USD to above 3,000 USD.

  Figure 7: Counterfeit Cash for Sale

 Administrators

Marketplaces are operated by admins, who ensure that the market is used in the way that they want and that the rules are followed. Some admins will also manage escrow services and a responsible for banning members who do not follow the rules. The admins of Ares Market are do a decent job of quality control on these listings because they are all related to credit card fraud. It is not uncommon to see less quality control and random products listed under the wrong categories on other marketplaces that are less reputable.

 Setting up DarkOwl Vision alerts on Ares Market

Select Ares Market from the lexicon

Then add in the vendor/username you are interested in monitoring, for this example I chose “counterking,” which returned 354 results related to this user

Next let’s create a monitor on future posts from this actor:

Simply go over and click the star highlighted in blue on the right-hand side of the search bar.

Followed by entering in the information to save your alert, choose your alert frequency and alert criticality and then clicking the box to receive email notifications and finally hitting the save button.