Hansa (market) explained

Hansa Market
Url:[1]
Commercial:Yes
Type:Darknet market
Registration:Required
Language:English
Current Status:Offline

Hansa was an online darknet market which operated on a hidden service of the Tor network.

On July 20, 2017, it was revealed that it had been compromised by law enforcement for several weeks before closing shortly following AlphaBay as a culmination of multinational law enforcement cooperation in Operation Bayonet.[2] [3]

Compromise and Seizure

See main article: Operation Bayonet (darknet). Dutch police discovered the true location in 2016.[4] Law enforcement quickly began monitoring all actions on the site. Administrators soon moved the site to another unknown host, but law enforcement got another break in April 2017, which allowed them to identify the new hosting company, in Lithuania.

On June 20, 2017, German police arrested the administrators (two German men) and the Dutch police were able to take complete control of the site and to impersonate the administrators. The following changes were made to the Hansa website to learn about careless users:

Shutdown

When AlphaBay was shut down on July 4, the expected flood of users came to Hansa, until Hansa's shutdown on July 19/20. During this time, the Hansa userbase (grew from 1,000 to 8,000 vendors per day[3]). Law enforcement allowed the userbase to grow during the seizure resulting in 27,000 illegal transactions occurring which served as evidence for future prosecution of the users.[4] [7] Local cybercrime prosecutor Martijn Egberts claimed to have obtained around 10,000 addresses of Hansa buyers outside of the Netherlands.[8]

After shut down, the site displayed a seizure notice and directed users to their hidden service[9] to find more information about the operation.

Notes and References

  1. Web site: Deep Dot Web - Hansa . dead . https://web.archive.org/web/20150812110545/https://www.deepdotweb.com/marketplace-directory/listing/hansa-market . 2015-08-12.
  2. News: 20 July 2017 . Massive blow to criminal Dark Web activities after globally coordinated operation . 20 July 2017.
  3. Web site: 20 July 2017 . Underground Hansa Market taken over and shut down . Politie (Dutch Police) . 21 July 2017 . 21 July 2017 . https://web.archive.org/web/20170721082011/https://www.politie.nl/en/news/2017/july/20/underground-hansa-market-taken-over-and-shut-down.html . dead .
  4. 2018-03-08 . Operation Bayonet: Inside the Sting That Hijacked an Entire Dark Web Drug Market . Wired.
  5. Web site: Cox . Joseph . August 25, 2017 . This Is How Cops Trick Dark-Web Criminals Into Unmasking Themselves . The Daily Beast.
  6. News: pxx51092 . July 25, 2017 . DON'T open the xlsx locktime file, beacon image confirmed in it with Hansa's server IP address . . https://web.archive.org/web/20171009150823/https://www.reddit.com/r/DankNation/comments/6pi0et/dont_open_the_xlsx_locktime_file_beacon_image/ . October 9, 2017.
  7. Web site: Riggs . Mike . 2017-07-26 . Five Lessons from the Hansa and AlphaBay Busts . 2017-07-26 . Reason Hit&Run.
  8. Web site: Satter . Raphael . Bajak . Frank . 2017-07-21 . Dutch 'darknet' drug marketplace shut down . 2017-07-22 . Portland Press Herald.
  9. News: DeepDotWeb . 31 October 2016 . Dutch National Prosecution Service and police launch Hidden Service in global Darknet enforcement operation . dead . 26 July 2017 . https://web.archive.org/web/20161101124749/https://www.deepdotweb.com/2016/10/31/dutch-national-prosecution-service-police-launch-hidden-service-global-darknet-enforcement-operation/ . 1 November 2016.