We Analysed 1,125 Dark Web Listings in 30 Days. 83 of Them Sell the Parts to Build a Fake Customer.

Most dark web research counts breaches. We wanted to know what happens to the data afterwards, so for thirty days we catalogued many listings our collectors indexed across criminal forums and Telegram channels.

Eighty-three of those listings were selling a component of the same product.

A person.

Specifically, a person capable of passing your identity verification: opening a bank account, registering on a crypto exchange, clearing a KYC review at a betting site. Every stage of building one is sold separately, by different specialists, priced independently, and all of it appeared within the same two weeks on the same handful of venues.

Laid end to end, it looks less like a criminal underground and more like a manufacturing process.

Stage one: the document

The raw material is a real identity document, and it is abundant.

On 10 August a seller offered 800 French ID cards in a password-protected archive. The following day, the same handle listed 8,000 US passports. Neither posting bothered to explain what a buyer would do with them, because on these forums the use case is understood.

The most instructive listing appeared on 14 August: 100,000 Swiss and Italian ID and tax document sets, advertised as under three months old, with MRZ data already extracted. MRZ is the machine-readable zone — the two lines of code at the bottom of a passport that automated verification systems actually parse. Somebody had done the extraction work in advance and priced it in.

The listing named its market outright: banking and KYC use.

Listing 1: Sale offer of 100k Swiss and Italian ID and tax document sets

Listing 2: Sale of 8000 US passports in password-protected archive

Stage two: the face

A document by itself fails any verification flow built after about 2018, because those flows ask for a selfie. So selfies are sold too.

On 17 August we indexed a Telegram bot offering automated sales of scanned passports, IDs, driver's licences and selfies, spanning roughly 120 countries, paid in cryptocurrency. No negotiation, no vendor conversation — a vending machine for identity.

Three days earlier, a seller using the handle ПАНТЕРА advertised photo sets of individuals intended for document forgery and identity verification bypass, offering selfies and document images matched "for various verification scenarios." That phrase does specific work. Different platforms demand different poses: holding the document beside the face, holding a handwritten note, a particular angle. The inventory is organised by which check it defeats.

Listing 3Actor offers photo sets for identity verification and document forgery

Stage three: proving you are alive

Liveness detection was the industry's answer to exactly this. On 9 August a user posted asking how to beat it — sceptical about deepfakes, wanting to know what actually works.

The question matters more than any answer he received. Liveness is treated as a solved problem in most vendor marketing. On the forums it is treated as an open engineering discussion with an active research community.

Stage four: an address, a phone, an IP

Verification rarely stops at the face. It asks where you live, what number you answer on, and where you are connecting from. All three are on sale.

A shop trading as utility-bill.shop sells PDF templates for confirming residence, income and bank transactions, with regular updates and customer support. Proof of address, as a subscription.

For phone numbers, one vendor offers physical and eSIM cards across more than thirty countries, issued against scanned documents — the output of stage one feeding directly into stage four.

The clearest illustration came from a single seller on a single day. On 14 August, persik.us posted three separate listings: private SOCKS5 proxies advertised specifically for PayPal work with a thirty-day guarantee; aged PayPal accounts, over a month old, bundled with cookies and personal data; and US Google Voice numbers with two-factor authentication already enabled.

Read together, those three products are one product. The proxy supplies a plausible location, the aged account supplies history, and the phone number receives the code that confirms both. This vendor understood the customer's whole problem and sold the whole solution.

Listing 4:Persik.us sells private SOCKS5 proxies for PayPal use with 30-day guarantee along with Voice numbers.

Stage five: the finished account

At the end of the line, someone sells the assembled result.

A service operating as JOHNYMONEY offers verified accounts at European neobanks, crypto exchanges and corporate banking, complete with virtual numbers and linked email addresses, across Estonia, Latvia, Lithuania, Czechia, Poland, Spain and Bulgaria. A seller using @Panther_Documents offers full identity records for registering on crypto exchanges, wallets, bookmakers and casinos in the UK, Germany, Spain, Italy, the US and Canada, with CIS countries explicitly excluded — a jurisdictional choice that tells you where the operators live.

Stage six: the humans

Some verification steps still need a person. So people are recruited for them.

On 16 August a handle called @DARKPAINT_ADMIN advertised for drop handlers and verification drops holding European documents, for website and app verifications, paying between $10 and $500 per job. The range reflects difficulty: a throwaway signup at one end, a bank account in someone's real name at the other.

Stage seven: when it goes wrong

The stage that convinced us this was a mature market rather than a collection of scams is the aftermarket.

On 18 August, a service offered to help clients unblock funds frozen by AML and KYC checks at exchanges, wallets and payment platforms — including document preparation and direct correspondence with compliance departments. Fees start at $3,000.

An industry only develops remediation services once enough customers are getting caught to make helping them profitable.

Listing 5: Service offered to assist with unblocking funds after AML/KYC checks

What this means if you run verification

Three things follow from thirty days of watching this.

Your controls are being tested as a set, not one at a time. Document, face, address, phone, IP and account age are sold by different vendors precisely because attackers assemble all six. A verification stack evaluated control by control will score well and still be beaten by a customer who bought the full kit.

Fresh matters more than volume. The Swiss and Italian sets were marketed on being under three months old. Stolen credentials are commodity; recent, complete, coherent identity sets carry a premium. Detection tuned to known breach corpora will miss the material that commands the highest price.

The gap between a breach and its use is a supply chain, and supply chains are observable. The documents in these listings came from breaches that happened somewhere else, months earlier. Watching the resale market gives defenders something a breach notification cannot: advance warning about which identity data is circulating, which countries are in demand, and which verification flows are being targeted this month.

Every listing referenced above was indexed within a thirty-day window and remains in our archive with its original timestamp. The figures are the sellers' own claims, and sellers overstate. What cannot be overstated is the shape of the thing: eighty-three listings, nine stages, buyers and sellers on both sides, running in the open.