In DarkOwl’s Darknet Marketplace Snapshot blog series, our researchers provide short-form insight into a variety of darknet marketplaces; looking for trends, exploring new marketplaces, examining admin and vendor activities and offering a host of insights into this transient and often criminal corner of the internet. 

Don’t forget to subscribe to our blog at the bottom of this page to be notified as new blogs are released featuring different darknet marketplaces on an ongoing basis.

UpShop Market

UpShop is a small darknet marketplace that specializes in the sale of stolen or compromised digital accounts. These listings advertise account credentials for Microsoft accounts, Wells Fargo accounts, iTunes accounts, and many others. They also have a section dedicated entirely towards the sale of stolen (or potentially fraudulent) identities, with each advertised item consisting of a Social Security Number and its corresponding City, State, and Zip code.

Since its opening back in mid-December 2017, the market has been casually promoted across several Russian and English-speaking deep web criminal forums, including, XSS, Dedik, WWH-Club, Gerki, Beznal, and Club2CRD.

The administrator/s of UpShop have been relatively quiet this past summer and into this fall, and have not publicly posted market update since early-May, 2020. Nevertheless, at the time of this posting business at the underground market appears to be continuing as usual.

The price of stolen accounts on UpShop

Over the course of our most recent observations, DarkOwl researchers noted that there were 3,121 stolen accounts being advertised for sale. This is up from the 2,981 that we noted as the total number of listings earlier this summer. Whether UpShop will continue to follow this trajectory has yet to be determined, but as we mentioned earlier, the underground business does seem to be fully operational at this time.

Other findings include:

• The average price of one stolen account on UpShop market is $6.33 USD.

• The stolen accounts are associated with 40+ different merchants, who seem to primarily be retail merchants like Target and Khol’s.

• Sam’s Club and Walmart accounts make up 46.46% of the total number of stolen accounts advertised for sale.

• The price of one stolen Sam’s Club account ranges between $2.50 USD to $5.00 USD, while the price of one stolen Walmart account ranges between $5.00 USD to $6.00 USD.

• The price of each listing is largely determined by the amount of personally identifiable and financial information fixed to each account.

•  Additional Market Observations and Related Findings:

• The staff members of UpShop have been tied to several usernames including, upshop33 – which appears to be their main moniker – as well as malkincheff, and ElskChief.

• Only 5 vendors total are responsible for trafficking all of the stolen account data into the market, including, Like_a_Boss, BestStuff, romulan, applewarrior and drobdead. 

• UpShop has a built-in identity theft store. At the time of this writing, 10 identities are advertised for sale. The average price of one stolen (or potentially fraudulent) identity is $0.30 USD, which is rather low in comparison to prices across other identity theft stores we’ve observed on the darknet.  

• UpShop also has a built-in email-flooding service, a service whereby a cybercriminals can send a large volume of spam to a target’s email address, crippling their ability to manage their inbox. The price of each ‘flood’ is determined by the volume of emails sent to the victim’s email address.

 Thanks for reading this edition of our Darknet Marketplace Snapshot Series! Subscribe to our blog on our blog homepage to be notified whenever we publish a new piece.