Phishing: Ex-mod Explains How to Bypass Empire Market's 2FA System

~11 min read | Published on 2019-06-17, tagged Darkweb-MarketPhishing using 2503 words.

In a public paste, one of the most prolific entities responsible for phishing Empire Market users pointed out how easily he—or anyone with the ability to run a proxy—could bypass the marketplace’s “anti-phishing features.” The former Empire Market mod demonstrated how even when presented with the correct Empire Market address, the end user ignores the legitimate Empire Market link in the 2FA message.
“The end user is always the weakest link to a system,” the entity behind many of the Empire Market phishing proxies told darknetlive in an encrypted message. Just days ago, Empire Market staffer Se7en submitted a post on the Empire subdread titled “Market Update (New Anti-Phishing Feature / Disputes).”
Related Post: A Warning About Darkweb Market Phishing Sites
The update, according to the marketplace’s head moderator, added Empire Market addresses to the decrypted PGP messages. This allows users with 2FA enabled to double check the link in the message with the link in the address bar. If the links match, the user is accessing the market through a valid market link. If they do not match, “you are using […] a phishing proxy,” Se7en wrote in the announcement.
In a public paste on the onion service DeepPaste, godman666—an identity used by the Empire Market phisher mentioned in this article—demonstrated that even when confronted with the safe Empire Market link, the end user will often ignore it. And godman666 has some experience with Empire Market fraud; he formerly worked as an Empire Market mod responsible for handling fraud disputes and dealing with fraud on the marketplace’s forum.
The 2FA message contains the code used to login to the marketplace. Since many users just want to access the market before the link stops working, they simply grab the code and close the window with the decrypted 2FA message.

Empire Market 2FA



The proxy passes the encrypted message to the end user; the end user decrypts the message; the end user then unknowingly enters the 2FA code back to the proxy; the proxy passes the 2FA code to Empire Market. This anti-phishing measure would work if the end user had paid any attention to the measure itself.
Below is the message godman666 posted on DeepPaste with the passwords removed. They have already been used most likely. To the users in the paste: this is not Empire Market’s fault. It is yours. The market provided you with a way to prevent this from happening and yet you let it happen. Of course, Empire’s mirrors change by the minute, confusing even responsible users.
Some users, such as those with the username “heythere” and the password “FuckYouPhishingShit” seem to have been paying attention to the link in the 2FA message, proving that not everyone is willing to get phished.
Passwords have been redacted. Darknetlive has verified the a number of the accounts provided by Godman666.godman666- phished empire logs .. beating the new "2fa" anti phishing featurevariables:Array( [8e261e37a345c18616bba96596cef155c5cbbe2e] => shortie123 [da8c6ffc0d48969e70671d504a8d096b043db070] => 4** [b86282148f92ce7dec0a3c54b385cbfbd061d3fb] => 001524 [09b03deda0db21356277be3764455927880a66b1] => Login [token] => 25e4ba42b32c5845a51dd2fbd0e6ea01c36325ea [29ab524cfe4d124af54a8793c389bb9c7d10c6e7] => Login [d5a8a604673f6f2bcb42f5ec3489a9c577706da1] => Login [4367f474c3f718370de91b562424ceb816c5dad5] => Login [6e48ce8cf2ad57eb8ffd49d48477017d16bf4ca4] => Login)variables:Array( [f552da79031a0b692817b1a062534db95c8e77ca] => maccamccormack [19ad2a0c1750d43ac69f86d3fb1b17a60a310abe] => ma** [45adf25d5ebd5bb1846f380787ce870fd9ee73b9] => 282899 [a44e31d4bd64ff49a6c8e71477b59d1b968ce34a] => Login [token] => f43c5bd84112b7f14e4bd490751689c0db9af863 [50bcdbcd7dde54cd643d16ae8cd8f31133b7be74] => Login [02bd09dda3b3eefafff306b33ea98ece93bb4e74] => Login [ac592b22b59ad239b6e4cabc5e9f1e574fec1731] => Login [b4fc379e521c0acbd84e8cac0824a44e75c0e34e] => Login)variables:Array( [588554c1a452911a028d7527be904a9cb6f64029] => happy19 [c9fe86b3a9c840c3e8e59f069f0e820b22be8b08] => $$** [da5f5393a90c646eefc7b7d4bd3675ff6aa45f47] => 2853618 [537e5997d77376f8832db346e92bc815f58adb62] => Login [token] => bd25546e36d1032dbf64dc35f9014f6678fa2560 [b2e7fe9a094b4c279d7f96bd72c54ce373e80d11] => Login [df71a2966763ef7e355f35bd12d824f836983ca4] => Login [207bd9db1a562d7958d7ed254917f92670a8deb0] => Login [d619dd9894e0e04dfd23d322f8a8145210448a78] => Login)variables:Array( [f552da79031a0b692817b1a062534db95c8e77ca] => maccamccormack [19ad2a0c1750d43ac69f86d3fb1b17a60a310abe] => ma** [45adf25d5ebd5bb1846f380787ce870fd9ee73b9] => 282899 [a44e31d4bd64ff49a6c8e71477b59d1b968ce34a] => Login [token] => f43c5bd84112b7f14e4bd490751689c0db9af863 [50bcdbcd7dde54cd643d16ae8cd8f31133b7be74] => Login [02bd09dda3b3eefafff306b33ea98ece93bb4e74] => Login [ac592b22b59ad239b6e4cabc5e9f1e574fec1731] => Login [b4fc379e521c0acbd84e8cac0824a44e75c0e34e] => Login)variables:Array( [799f68e99b89e6076d8ea3ff20238d2172ca7090] => nsahchaffee [36ff37aec9f5b570af712e0880f5bb1d9f5bcb0d] => 65** [e04ce878afd22a1bce59976451844cb9d8686093] => 955565 [badfcf24ba3bbdd1e676f00b940c8fabbadfe641] => Login [token] => b3b54cf4577e7b194596e694c0c6c33f46b4b903 [03e57ae133c3ef97b8031f1df542a651a8161167] => Login [1b2dd2fd1fa250fe7fc0189ca2bf61452eb021f5] => Login [761a6a448dda2b9b06429d828e5a93c704e54e4c] => Login [0f53428398315ef2e0f623edcc93775771a70b7d] => Login)variables:Array( [a61efd7ef926970bef1079be6bf2e10076c697f9] => davethdrave [7bb93189eb1b175031bd27ccf84538f582ca53e3] => bra** [54e7c4ccca464f2b7e5929d28b72f5a926ac0d04] => 5927274 [53b36c3625ff6f4944702702339899a4ee9ad9af] => Login [token] => c5975713a6dedab49748da7d69b1abdbe47c5428 [1318e20ebd9fc607d13942a4cd5cd61fb194d59f] => Login [41e57b152002284884fe7484f83b8c23cbbf76d0] => Login [cc228bc1ede611b47dfee7e9cbbad9d61cd5f98a] => Login [f8b07c063553156ad8e10a84eae9b5e774fdbfbd] => Login)variables:Array( [8f3d4d7211c20484c30aaefd7760b1060ff4fedf] => [5e211ff1b32d882463494ddd8a3e807fca703602] => [20714bf501ace89d9b1c4b3712adc1143892c960] => [f2e7cd9fa8e599176328f539790e7ce847533a2d] => Login [token] => f26070efeec4c5773d6ff17379ef524ae9141034 [b85d83874c37968d32b06def0518aa7bb556cdee] => Login [d353da518a440fabdc8ab479ad13f9ae1ec956b5] => Login [5b14b13beb4f6cef0567b96b4b3ce23f302c6de8] => Login [5a3118fa80e443f82a9be4859f17cf43b5294282] => Login)variables:Array( [c5988b9034585775b888cddab714b6cce3c01da3] => robloxmaster69 [3ecd1599e7b448e5524fa7b2251c8058a4f34a82] => Lu** [d391463f1f62f430fa1e295916c3ddd6bda83105] => [bc6df4562f8a249366a89ecf8f412e2437131d02] => Login [token] => f4b6e3f0739f6f70f1d8eb1963e6ba53ee103c61 [cd66d7b06198ba477e1b9777fe4ef1c866530194] => Login [12f6a18e91f6cfd1a59a4e7a7246d122440603ee] => Login [7b0541b0c27e901ffca5a604c93fea995ec96131] => Login [99983ed0911337dc4b54c06b996f08ec6e0babb6] => Login)variables:Array( [c98a8e182b89cdc4d303c95ea104ffab465c482e] => radovednismuk [cfe2e0101ad4a38bf283c72396361729052a810b] => ra** [55d2d0907a9abbf0eca53452ed45ead27afbb9ac] => 42230 [4317ba8564fc4a700732582024cd55ae47fa92b2] => Login [token] => cfbaf8babe564f6f760c8421beaad00c9a754c66 [467e38fa1956d3c6e1422452b8aaf8e75299d741] => Login [cb1261f147a07cb727818a7796e9515c617056d4] => Login [f45b8029adc17b800e941ee70703f23c4c0898ef] => Login [a0edfb083d9039a418d7cff8d9a883e3ff65c125] => Login)variables:Array( [0991683fa5ae99de65665456d30ef0d21210f1d1] => amitk28 [8deef51ae67783a0e289ba9b7c326142bb58a87c] => ak** [6179d74bba3006d4436f7828605b9ab43bbb85ed] => 9816041 [db2459c369d42f9ab11bc24658ba13c46297fcc5] => Login [token] => 56f126da0112958bdcb0b3457dc442bd416808b0 [f00eded557028f9a0f884c5864d79e2282d67d5b] => Login [00c50c7e12834044fffc3985fe33092ec5f61554] => Login [9bdf5ec129e74e29f7c489fdc4e0760e11e8777c] => Login [366dec410bb7d5f3c2d165ab9bc6ee62f4484b08] => Login)variables:Array( [UuqBABFmpW8b4UYg] => cGVXbXVtZXJyalBGVzZZUFNQZ1B2UT09 [token] => 4a46137e3e778c8ff3c2634dab777070d622a86d [ZDgEKbk73nm6QJGM] => N1RRTEI3cGNFL1hSajNyb2NxdEs2dz09 [btnfinalize] => Finalize)variables:Array( [confirm] => Yes [id] => cGVXbXVtZXJyalBGVzZZUFNQZ1B2UT09 [s_id] => N1RRTEI3cGNFL1hSajNyb2NxdEs2dz09)variables:Array( [5fa5409343a6235f09f6b8e4f5a78b0aae2e7afe] => ACABsweet121 [c401d5b9f431313daf1547492efbbb2b7bedc132] => Du** [c101a828557c1db4951c8b4c1a1e7ceeaa5dd79f] => 2320446 [64f9d4b80f57ccb9f6bf1b28dccaf0199ae63d4d] => Login [token] => 886d664bdc6053f4a6fd35f77bad5d86914338e4 [418b1b6e8cb67898ef4cb47026fe97b2b70200da] => Login [878f630454b4b85be48b7c8a1a0b03dcd7740cb6] => Login [bcfb38a67a3d9655a848914477b09ffb54b6a5ab] => Login [8197c6b05a7ad2e527f44a83e5a2928673102172] => Login)variables:Array( [uname] => vegeta33 [password] => G**** [confirm] => G**** [pin] => 5**** [loginPhrase] => b [inviteUser] => [currency] => USD [crypto_default] => bitcoin [captcha] => 379136 [register] => Join Empire Market)variables:Array( [uname] => vegeta33 [password] => Ge** [confirm] => Ge** [pin] => 571201 [loginPhrase] => b [inviteUser] => [currency] => USD [crypto_default] => bitcoin [captcha] => 539907 [register] => Join Empire Market)variables:Array( [mnemonic] => gets **** [conitnue] => Continue)variables:Array( [204a5045c5dc037e2653aa566f4b00211c7e1661] => vegeta33 [6c63219f3e774526d0ae1aa552f7b293bf665a83] => **** [4f79d389d2cca38b7206441c1e76d93777f58306] => 364479 [1bbdb3900bb36ded08aead77f2109bc974a5a0d3] => Login [token] => 1953c8356df678fbfa759c33c68d14ad8297cb81 [43b293f8ddae6dbc133d62bbfdc82f7ae37aac29] => Login [e428ad174a6d1c1019c71ae2676812fbcbe61b37] => Login [b6892019ef509f8213fefec54abace6466f3da1c] => Login [af8d6a9543a9cf92d677c1e7d4c08daadf4bbc9d] => Login)variables:Array( [2a4121fa565182598fd64c6f99d6255686e05f46] => vegeta33 [ba7d8b94dfa7a2ab90a8ed59f345d5ef137f4632] => Ge** [9ce887afe6dbfda6b8dafe77dac9ef1dcb7b4d06] => 190245 [5d7c7d4df21823535cc3fb107215e7b95556dba7] => Login [token] => ecdacf7cc6045c3cae67c985b10621de92b15feb [195bef37c73cea3a53ac6338f4e93b1112f8c0df] => Login [f78d9a92f9457bd7b7e3babc6c86a9b5e93ceebe] => Login [d6c77183b3173479aa01c97abefc07ba6786529a] => Login [33a125f3c52dee8623dc1f1ed139293cc94eaf5b] => Login)variables:Array( [fdd56c254677a0fddb8fde9935dd8ca509e6bee4] => yadema [46040d79124a6faff6b2382a19aaa378575c78de] => ya** [679d42d3d9f44b51a8f2167b11994e684227c753] => 07720 [ce649043121ea0586a1b641e75a62ca42d03a81b] => Login [token] => 9dbc64d87735c7a3f76324d4be28b6f3721ff2db [1cd99f44ffce4fed9fa3c3751121dd5b270d036f] => Login [763b87e9914cb198b3ec4a0e0d17d68ed3059972] => Login [bea73034becbcc46d5b9d61c9156e0af02e65f23] => Login [fc5338867b6f78580714530d648ce43db9f0f5c8] => Login)variables:Array( [captcha] => 36121 [token] => 1705f68576ea36cb4aab51a13057ea20f1f746ea [check_captcha] => Verify Captcha)variables:Array( [title] => [btnclear] => [price_f] => [price_t] => [category] => All [origin] => Germany [ship] => All [order] => All [stock] => All [payment] => All [coin] => All [verified] => No [level_f] => 7 [level_t] => 10)variables:Array( [title] => [btnclear] => [price_f] => [price_t] => [category] => All [origin] => Germany [ship] => All [order] => All [stock] => All [payment] => All [coin] => All [verified] => No [level_f] => 1 [level_t] => 10)variables:Array( [id] => N1RRTEI3cGNFL1hSajNyb2NxdEs2dz09 [message] => It arrived man! So quick! I've not opened it yet as I'm at work but will check it out later and leave you some more feedback. I've finalized the order too. The websites been down for about a week and I've just managed to log on now after a struggle. Is there any other way I can contact you to order more if this site ever completely fails? Hate to lose contact with a trusted seller like you..Looking to order 3 ounces on the next order. [token] => c923cc1c2c569810d4a3a5deb27018f15ed2a3ad [token_2] => 6c3eb194014aab5cca46912d89ff2ffc49d21e6c)variables:Array( [e0dde78bc52ad4d5251cfb48a885fd7c9c87c47e] => heythere [3809e80e4a50bc830347505ddeca89b5cfb771a9] => FuckYouPhishingShit [c2b25b4b8f832aa92cd2f17c3bf12a06f675abe3] => 60571 [34e979c2c1c2122909bc5650dbdfd2372465b3bd] => Login [token] => 3b75fe43a5e7405b607fc27e30468657d2ad0034 [0b913050b7f1b7e5f39f3c85fb76725b66b2c49d] => Login [199fc52dfbbec00b857403b9a44e4fcab05cbff7] => Login [4c87989105682f16f86b281209cd20eb66a6c816] => Login [5cf7600c671c728ba15c2c18175f9fa807ccc66f] => Login)variables:Array( [37354f1c3b685774cf70d5f6a1a1ddc0f6c35923] => heythere [6c86f355672b1a197e94e2e6549250b67dbb5e48] => FuckYouFuckYou [bab8924a377acd29720bea4fe657d04c08ca9ae3] => 95835 [5088e392170fd72c611d5328d2232dce2a9a5ea1] => Login [token] => 3aa6697eb6b1f465f169183a3a9990e4efdb4995 [e313ea515dbab161269ed2ceeab428472a78334f] => Login [630af873e57d01f2c99f54e30622ef214acdf466] => Login [aa73852344b8b21e0dea64e8a403f269db623f12] => Login [c3d0fa57607b1d07bbc070b5649aa56cad0ba6d8] => Login)variables:Array( [uname] => fuckyoufucky [password] => againandagain [confirm] => againandagain [pin] => 888888 [loginPhrase] => gagaga [inviteUser] => [currency] => EUR [crypto_default] => bitcoin [captcha] => 292262 [register] => Join Empire Market)variables:Array( [mnemonic] => easily ipad market love pears gray white cosec second [conitnue] => Continue)variables:Array( [e2e8c6deff12effd92a96e7d93cafc25f5a3208a] => fuckyoufucky [1d56c53c130ed3871ad24b8b52989bc014dc26e9] => againandagain [b3696a1325b3ab40a137aac151e3f50476c3d6ea] => 7771807 [c5fa994ac440073aa8853405e993106696c2d425] => Login [token] => 3747d70cb0a9ac21a7bc3e20846f3f36f2f43837 [fa9044e23c864e609e1d6843ac85d8ccb021af42] => Login [aefbc1436f259480bf53c1a1d35937babed5af4e] => Login [2e3853ef9550e54cceb2db7a6827f55c0f5f618d] => Login [a5215c45fddf9b7049960d428cc61ec1ddd78423] => Login)variables:Array( [id] => N1RRTEI3cGNFL1hSajNyb2NxdEs2dz09 [message] => Thanks again bro. Just wondered when you're next expecting to reload on the weed? [token] => aed3a885253c5ab2d81277668fbeae01cf9f4118 [token_2] => 2d9e3b8b6f1d525374aa7fbe180a10e1370eba81)variables:Array( [42507833f51c9dec8936bd5fd396be31faa62a35] => tati23 [06b4a583fac4006a9fcf6d194caa1cd66f640e72] => chr** [68c243347c1df9f2f611949201314e42497b8c55] => 213615 [25981712f2d06a4a9cda8823590821a72150072c] => Login [token] => 399ffc85f0c49025c2a54be0ea4be2233fc0ecbc [fd7c89aa064dc550b62c142ebbe391f561751317] => Login [2c44e62613f363c124823cca9f8144240faee54d] => Login [0a256fae4d40cda3db2994b004c2eb6a6af82b1c] => Login [5e2d24d21a9b991e5e008c4332149acad8aa28a1] => Login)variables:Array( [title] => [btnsearch] => [price_f] => [price_t] => [category] => 73 [origin] => Canada [ship] => World Wide [order] => All [stock] => All [payment] => All [coin] => All [verified] => No [level_f] => 1 [level_t] => 10)variables:Array( [6c83d35dbcf942cc2845aa03397dc5354cd8077d] => lisa199lisa199 [244dbf05f59f4d7b15df7b6f5d477e879a110876] => l** [d974b431169f9a653f8a58667768c10da9904d14] => 174317 [87ca1d4246704e7d1447398d493b95366bafebb9] => Login [token] => d6d3b69c3e66498b2d592d5c8c1cc917f3de2340 [1ef910abda482cdd02b1025da0eff6f4761a0d74] => Login [3bbd830b785afd99544ffea0871254fec8738950] => Login [3b46e935017ddc39416bc80bd289ae9b312eb592] => Login [150cd4797b097bd80b072c6cca2989c8db468d89] => Login)variables:Array( [reciever] => Surface_365 [subject] => tati23 [id] => 204894 [message] => Hello surface! Sorry for disturb,i have ordered from you yesterday but you don't accept my order. Is this so because its very difficult to login here on empire? I need the order very fast. [captcha] => 229425 [token] => afc6782ae9c8a0f204030fad312d43522c0b2724 [token_2] => 29b01d1a51a7e1aaeb47df71399cb516bc4d1293)variables:Array( [27d3a2e23f668a977eceb17f8a082fa3960001f5] => lisa199lisa199 [8da74b5922db03958f6c4da67d99e4d323db9825] => l** [0d35757ddce2648cef17e73f8c975649f4cb60d2] => 984563 [c881058bbd9c4ef4330cdaedd43f5c582fe55c4d] => Login [token] => 5ea6d14990cea77412c6d81225121bc452c31768 [57b1dbf84cb5d22652de2d5c68a6f1e5321af54b] => Login [216a0e1cbb387494deda25f69740bce52b013534] => Login [a8bcb62947ce6391336c3a8384442925307acbac] => Login [936ac2f03cec8de45630cb619dc9a490cfffe6f8] => Login)variables:Array( [a420eb7e853b1dd7bcf80619fa864036c7aaea75] => lisa199lisa199 [19ddc3ec3e53990bd4b6bc6b154fdb401e1b0fed] => l** [536e95440c5970629089aef4d726e44da6b999b5] => 663980 [cd12a725d0e6914769123171328bf19066aab9d8] => Login [token] => 87f39753b58256f836ac3d1653de374b2912b324 [929e9feb6a6217a936972606c746830b1bf95334] => Login [3a181f054d2a2ab3fa8c2d9f3a2eaafaad60e614] => Login [fd34dd24a1cffd5371a5679f5050a51a13b760f0] => Login [40723485f29e4c3fa0933e1c922f8f883bd714b3] => Login)variables:Array( [captcha] => 1906882 [token] => a143417630262a112a274aace85f9dad61dc05d5 [check_captcha] => Verify Captcha)

This user, for instance, most likely noticed:variables:Array( [uname] => fuckyoufucky [password] => againandagain [confirm] => againandagain [pin] => 888888 [loginPhrase] => gagaga [inviteUser] => [currency] => EUR [crypto_default] => bitcoin [captcha] => 292262 [register] => Join Empire Market)variables:Array( [mnemonic] => easily ipad market love pears gray white cosec second [conitnue] => Continue)variables:Array( [e2e8c6deff12effd92a96e7d93cafc25f5a3208a] => fuckyoufucky [1d56c53c130ed3871ad24b8b52989bc014dc26e9] => againandagain [b3696a1325b3ab40a137aac151e3f50476c3d6ea] => 7771807 [c5fa994ac440073aa8853405e993106696c2d425] => Login [token] => 3747d70cb0a9ac21a7bc3e20846f3f36f2f43837 [fa9044e23c864e609e1d6843ac85d8ccb021af42] => Login [aefbc1436f259480bf53c1a1d35937babed5af4e] => Login [2e3853ef9550e54cceb2db7a6827f55c0f5f618d] => Login [a5215c45fddf9b7049960d428cc61ec1ddd78423] => Login)