Section 07 · Glossary

Glossary

The vocabulary of darknet marketplaces, as used in this file and in the sources behind it. Definitions are for understanding — not for doing.

Clear web: The ordinary, publicly indexed internet — pages findable through standard search engines. Most of the chaos around a marketplace's name happens here, not on Tor.
Dark web: Content reachable only through anonymity networks such as Tor, and not indexed by ordinary search engines. "Dark" refers to accessibility, not to a single physical place.
Tor: Anonymity software that routes traffic through a chain of relays; the name comes from the original project title, "The Onion Router". Using it is not itself unlawful in most countries — what matters is what is done with it.
Onion service: A service reachable only from inside the Tor network, identified by an "onion" address rather than a domain name.
Darknet marketplace (DNM): An online platform where vendors trade illicit goods — drugs, stolen data, fraud tools and more — with payments in cryptocurrency. Structurally it resembles ordinary e-commerce; legally and practically, it is a criminal enterprise.
Escrow: A transaction system in which the platform holds the buyer's payment until a deal completes. On marketplaces, escrow concentrates every deposit under the operators' single point of control — which is exactly what makes exit scams possible.
Vendor: A seller on a marketplace, usually operating under a pseudonym and often paying a commission (or a "bond") for the right to sell.
Exit scam: When a platform's operators take the funds users have entrusted to it and vanish — sometimes slowly, sometimes with a blackmail note attached. Documented repeatedly in this file; the norm rather than the exception.
Seizure / takedown: Law enforcement taking control of a platform's infrastructure, usually announced with a splash page. As the record shows, a takedown often marks the start of investigations into the platform's users, not the end of the story.
Honeypot: A platform or service secretly operated or watched by investigators to collect data on its users. Hansa is the textbook case: it was run covertly for about a month while displaced users streamed in.
Autoshop: A marketplace specialising in the automated sale of digital goods — card data, credentials, malware — where delivery is instant and no escrow is needed.
Fullz: Slang for a complete enough package of a person's personal and financial data to commit fraud in their name.
Credentials / stealer logs: Usernames, passwords and session data captured by malware from infected devices — a core product category across marketplaces and autoshops.
Monero: A cryptocurrency designed for stronger privacy than Bitcoin. Newer marketplaces increasingly accept only Monero; analysts treat that shift itself as a signal about the ecosystem.
Phishing: Impersonating a trusted service to capture what a person types — passwords, card numbers, identities. The primary clear-web threat around any famous marketplace name.
Mirror: A claimed alternate address for a site. In this ecosystem, the word itself is bait: pages offering "working mirrors" are among the most reliable vectors of phishing and fraud.
CASL: Canada's Anti-Spam Legislation, in force since 2014. It covers far more than inbox spam — and it is the law under which Canada announced CA$300,000 in penalties in the Canadian Head Quarters case. See Canada.
Notice of violation: An administrative enforcement instrument of the CRTC: it alleges violations and proposes a monetary penalty, which the recipient may pay or challenge.
Undertaking (CRTC): A negotiated settlement recorded by the CRTC, typically involving a payment and conditions. It resolves a file without a finding of guilt.

Where a term above connects to a documented case, the case pages carry the references: Consequences, Canada, Phishing & clones.