German police take down Kingdom Market, a darknet emporium of illicit goods

German law enforcement has seized the servers of the darknet marketplace Kingdom Market, a bazaar for drugs, malware, fake documents and other tools for cybercriminals.

In a press release on Wednesday, the police said they posted a takedown notice on the website and are now analyzing Kingdom Market's server infrastructure to identify the people behind the website's operation.

Schlag gegen Cyberkriminelle: Das #BKA hat im Rahmen einer internationalen Aktion die Darknet-Plattform „Kingdom Market“ abgeschaltet. Über 42.000 kriminelle Angebote von Drogen bis hin zu Schadsoftware sind damit nicht mehr verfügbar. Mehr Infos: https://t.co/GHrwDg4Tqz pic.twitter.com/xexExlOs0K

— Bundeskriminalamt (@bka) December 20, 2023

One person allegedly connected to Kingdom Market was identified last week as Alan Bill, a Slovakian national, who also went by his alias "Vendor," according to U.S. court documents.

U.S. law enforcement agencies "closely cooperated" with Germany in the operation, along with police from Switzerland, Moldova and Ukraine.

Kingdom Market was an English-speaking marketplace operating since March 2021. It offered more than 42,000 items for sale, including around 3,600 products from Germany. German police claim that "tens of thousands of customer and several hundred seller accounts" were registered on the marketplace.

The website's operators accepted bitcoin, Litecoin, Monero and Zcash cryptocurrencies for payment. They also received a 3% commission for processing the sales of illegal goods via the platform.

This is the second major darknet website takedown this week after the FBI seized the website of the AlphV/Blackcat ransomware gang on Tuesday. AlphV/Blackact affiliates have compromised over 1,000 organizations and received nearly $300 million in ransom payments.

Shortly after the FBI posted a takedown notice on the AlphV/Blackcat website, the hackers replaced it with their own message claiming they had "unseized" the page and brought it back under their control.

Many researchers, however, doubted this claim, saying the hackers were able to make it appear back online because the website where they listed victims was run as an onion service, a specialized type of anonymous website that can only be accessed over the Tor network.