The servers of the darknet marketplace Kingdom Market, which served as a bazaar for illegal drugs, malware, forged documents, and other tools for cybercriminals, were taken over by German law enforcement.

The police said in a press release on Wednesday that they have taken down the website and are currently looking into Kingdom Market’s server infrastructure to find the individuals responsible for running the website.

According to U.S. court documents, Alan Bill, a Slovakian national who also went by the alias “Vendor,” was one of the individuals purportedly associated with Kingdom Market. He was identified last week.

Along with law enforcement from Switzerland, Moldova, and Ukraine, U.S. agencies “closely cooperated” with Germany during the operation.

Since March 2021, Kingdom Market has been an English-speaking marketplace. It had over 42,000 items for sale, with about 3,600 of those coming from Germany. There were allegedly “tens of thousands of customer and several hundred seller accounts” registered on the marketplace, according to German police.

The owners of the website accepted payments in the cryptocurrency forms of Zcash, Litecoin, Monero, and Bitcoin. For handling the platform’s illegal goods sales, they were also paid a commission of 3%.

After the FBI took control of the AlphV/Blackcat ransomware gang’s website on Tuesday, this is the second significant takedown of a darknet website this week. Almost $300 million in ransom payments have been made to AlphV/Blackact affiliates who have compromised over 1,000 organizations.

The hackers replaced the FBI’s takedown notice on the AlphV/Blackcat website with their message shortly after it was posted, stating they had “unseized” the page and taken control of it again.

However, several researchers cast doubt on this assertion, arguing that the fact that the website listing the victims was operated as an onion service—a particular kind of anonymous website that can only be accessed via the Tor network—explains how the hackers were able to make it appear back online.

German Police Conduct Global Operation to Destroy Dark Web Hub “Kingdom Market”

Kingdom Market was a dark web marketplace that sold drugs and malware to “tens of thousands of users.” German law enforcement has announced that it has been disrupted.

The Federal Criminal Police Office (BKA) stated that the exercise started on December 16, 2023, and involved cooperation from authorities from the United States, Switzerland, Moldova, and Ukraine.

According to reports, Kingdom Market has been operational since at least March 2021 and facilitates the trafficking of illicit drugs, malware advertising, criminal services, and forged documents. It is accessible through the TOR and Invisible Internet Project (I2P) anonymization networks.

Before the English-language platform was taken down, up to 42,000 products—3,600 of which were German—were sold through several hundred seller accounts.

The website operators received a 3% commission for handling the sales of the illicit goods. Payments for transactions on the Kingdom Market were made using cryptocurrency, specifically Bitcoin, Litecoin, Monero, and Zcash.

The BKA stated that an inquiry into the seized server infrastructure is still underway and that the operators of “Kingdom Market” are “suspected of commercially operating a criminal trading platform on the Internet and of illicit trafficking in narcotics.”

In addition to the seizure, a single individual involved in the operation of Kingdom Market faces money laundering and identity theft charges in the United States. Vend0r and KingdomOfficial, other aliases for Alan Bill, are claimed to be Slovakian nationals.

The development coincides with the dismantling of the BlackCat ransomware’s dark web infrastructure, which was the result of another concerted law enforcement effort. This led the group to react to the seizure of its data leak site by seizing control of the page and declaring that they had “unseized” it.