The dark web is famous for the trade of weapons, drugs, and child porn. But a handful of vendors on underground marketplaces advertise rather more high-brow fare: Burberry handbags, reduced hotel tickets and flights, and discounted trips to Disneyland.
Although these items certainly aren't the most popular on the dark web, buyer data and reviews suggest at least a few people have taken advantage of the services and products on offer.
One listing on AlphaBay, likely the largest and most popular dark web marketplace at the moment, advertises a three-course dinner for two at London landmark The Shard.
"Take in breathtaking views of the London skyline. A three course Michelin Recommended meal," the listing reads. According to sales records—which are publicly posted whenever someone purchases an item—one person has paid the $50 asking price.
Another vendor called ETickets advertises Disneyland and Universal Studios Hollywood tickets. Not much information is given in the item description, but 23 people have apparently bought tickets since October last year.
"Inquired about tickets monday, placed order tuesday, received [sic] tickets thursday. Great Vendor with top communication couldnt be happier," one customer wrote in April of this year.
There are hints that at least some of the attraction tickets on offer may have been obtained through carding
One listing is for a flight and hotel package, with a minimum order of $500 and 17 buyers seemingly coughing up the cash.
Motherboard spotted 15 listings for similar items, though most had not resulted in any sales. Those included more trips to The Shard, a tour of the Houses of Parliament, and a family ticket for Shrek's Adventure, a children's attraction in London.
There are hints that at least some of the attraction tickets on offer may have been obtained through carding—that is, bought with stolen credit cards.
"I am selling carded Disneyland (and other theme parks as well) tickets at a rate of 30% [off] Disneyland website prices. Offering tickets for the park in California and Florida right now," one vendor wrote on the AlphaBay forums in April.
However, the theme park may have recently caught on to the scheme.
"Disneyland is toast man," one vendor wrote last week. "They IP log all the E-tickets now. Unless you are super careful about those tickets, they will cancel."
One way IP logging might interfere with carding is because the company could block connections from known proxy servers. A spokesperson for Disneyland Resorts told Motherboard in a phone call that the company works with law enforcement to combat this sort of behaviour.
Other tickets may be obtained through different underhand means. On one listing for half-price tickets from ticket merchant Eventbrite, a vendor writes, "These are NOT carded they are done via one of my social engineering methods. I recommend buying your tickets a week in advance. You just go to role call with the email I give you they scan it and they give you your wristband or whatever the event uses." Social engineering is when a hacker contacts a company and pretends to be someone else—perhaps an employee—to access information or services not usually available to them.
AlphaBay also has a huge selection of physical luxury goods on offer, including dozens of Burberry and other branded handbags, Seiko watches, and Fitbits. It's not clear whether these are counterfeits or the real deal.
Motherboard did not come across a single listing for a designer bag or watch that actually led to a sale, though over 50 Fitbits are listed as sold since August of this year.
This bizarre trade of items you're more likely to source from a travel agent or boutique store than a dark web marketplace may be pretty tiny, but it seems even those in the digital underground enjoy a little bit of luxury.
Luxury Week is a series about our evolving views of what constitutes luxury. Follow along here.
Get six of our favorite Motherboard stories every day by signing up for our newsletter.