Darknet Marketplace Snapshot Series: UpShop Market

In DarkOwl’s Darknet Marketplace Snapshot blog series, our researchers provide short-form insight into a variety of darknet marketplaces; looking for trends, exploring new marketplaces, examining admin and vendor activities and offering a host of insights into this transient and often criminal corner of the internet. 

Don’t forget to subscribe to our blog at the bottom of this page to be notified as new blogs are released featuring different darknet marketplaces on an ongoing basis.

UpShop Market

Screen Shot 2020-09-22 at 10.06.30 PM.png

UpShop is a small darknet marketplace that specializes in the sale of stolen or compromised digital accounts. These listings advertise account credentials for Microsoft accounts, Wells Fargo accounts, iTunes accounts, and many others. They also have a section dedicated entirely towards the sale of stolen (or potentially fraudulent) identities, with each advertised item consisting of a Social Security Number and its corresponding City, State, and Zip code.

Since its opening back in mid-December 2017, the market has been casually promoted across several Russian and English-speaking deep web criminal forums, including, XSS, Dedik, WWH-Club, Gerki, Beznal, and Club2CRD.

The administrator/s of UpShop have been relatively quiet this past summer and into this fall, and have not publicly posted market update since early-May, 2020. Nevertheless, at the time of this posting business at the underground market appears to be continuing as usual.

The landing page of Upshot Market, showing the various types of account credentials, as well as stolen or fraudulent identities, that vendors there are offering for sale

The landing page of Upshot Market, showing the various types of account credentials, as well as stolen or fraudulent identities, that vendors there are offering for sale

The price of stolen accounts on UpShop

Over the course of our most recent observations, DarkOwl researchers noted that there were 3,121 stolen accounts being advertised for sale. This is up from the 2,981 that we noted as the total number of listings earlier this summer. Whether UpShop will continue to follow this trajectory has yet to be determined, but as we mentioned earlier, the underground business does seem to be fully operational at this time.

Other findings include:

  • The average price of one stolen account on UpShop market is $6.33 USD.

  • The stolen accounts are associated with 40+ different merchants, who seem to primarily be retail merchants like Target and Khol’s.

  • Sam’s Club and Walmart accounts make up 46.46% of the total number of stolen accounts advertised for sale.

  • The price of one stolen Sam’s Club account ranges between $2.50 USD to $5.00 USD, while the price of one stolen Walmart account ranges between $5.00 USD to $6.00 USD.

  • The price of each listing is largely determined by the amount of personally identifiable and financial information fixed to each account.

The distribution of accounts by vendor as listed on UpShop Market

The distribution of accounts by vendor as listed on UpShop Market

  •  Additional Market Observations and Related Findings:

  • The staff members of UpShop have been tied to several usernames including, upshop33 which appears to be their main moniker – as well as malkincheff, and ElskChief.

  • Only 5 vendors total are responsible for trafficking all of the stolen account data into the market, including, Like_a_Boss, BestStuff, romulan, applewarrior and drobdead

  • UpShop has a built-in identity theft store. At the time of this writing, 10 identities are advertised for sale. The average price of one stolen (or potentially fraudulent) identity is $0.30 USD, which is rather low in comparison to prices across other identity theft stores we’ve observed on the darknet.  

  • UpShop also has a built-in email-flooding service, a service whereby a cybercriminals can send a large volume of spam to a target’s email address, crippling their ability to manage their inbox. The price of each ‘flood’ is determined by the volume of emails sent to the victim’s email address.

A screenshot of UpShop’s administrator promoting his or her market in Russian across Beznal - another darknet forum.

A screenshot of UpShop’s administrator promoting his or her market in Russian across Beznal – another darknet forum.


 Thanks for reading this edition of our Darknet Marketplace Snapshot Series! Subscribe to our blog on our blog homepage to be notified whenever we publish a new piece.

See why DarkOwl is the Leader in Darknet Data

Copyright © 2022 DarkOwl, LLC All rights reserved.
Privacy Policy
DarkOwl is a Denver-based company that provides the world’s largest index of darknet content and the tools to efficiently find leaked or otherwise compromised sensitive data. We shorten the timeframe to detection of compromised data on the darknet, empowering organizations to swiftly detect security gaps and mitigate damage prior to misuse of their data.