Markets: Incognito

Incognito Market was founded during October of 2020 and gained notoriety for offering unique features that were previously unseen on any other darknet market, such as governance proposals, where the community can vote for changes to the market, flexible language support, and an AI-based support system, where an AI chatbot can answer questions and respond to tickets. Incognito is entirely drug-oriented, with everything else being prohibitted for sale. Additionally, the market staff imposed a full ban on all opiates and opioids (hydrocodone, oxycodone, heroin, etc), along with all other narcotics that fall under the deliriant class, not just fentenyl like many other darknet markets. The market uses Bitcoin and Monero for transactions, and features multisignature escrow along with direct payments. The market’s staff created the “Incognite foundation”, with the intent “to maximize freedom, welfare, and privacy for all”. The foundation helps fund freedom and privacy-centered organizations like the Tor project and Monero. The staff has pledged a portion of their profits to the foundation, and users can freely donate to it.

Initially, users from the USA were prohibited from using the Incognito, but now they welcome buyers and sellers from all over the world. The team behind Incognito Market also created libre forum, a darknet discussion board.

Actions taken by Darkipedia

After witnessing the extortion made by Incognito, Ninja & Trojan decided to DDOS 30-35 mirrors with over 2,000 cores per mirror. This resulted in all the mirrors to appear offline so that others wouldn't fall for the extortion. At that moment, Pharoah tried to disconnect all their mirrors as their front servers couldn't handle it. The DDOS has been heavily effective due to Pharoah prioritizing low-end specifications rather than 1 massive server per mirror, or high end bandwidth with internal port speed.

Exit scam & Extortion

On 28th February, a few Incognito Market vendors reported missing withdraws. 6 days later, on 6th March, vendors were locked out of crucial market features and missing all withdraws. On 9th March, Incognito Market started to extort vendors and buyers, asking for payments in a range between $100 - $20.000 in accordance to the level of vendor market's.

The scam tricked both people buying and selling drugs on the platform. It began by freezing their cryptocurrency funds, so they couldn’t withdraw their money. Then, the scammers threatened to share the private chat details that were supposed to be secret. They warned that this would cause law enforcement to get involved. People who fell for the scam received a message like this.

“Expecting to hear the last of us yet?
We got one final little nasty suprise for y’all

We have accumulated a list of private messages, transaction info and order details over the years. You’ll be surprised at the number of people that relied on our “auto-encrypt” functionality. And by the way, your messages and transaction IDs were never actually deleted after the “expiry”…
SURPRISE SURPRISE !!!

Anyway, if anything were to leak to law enforcement, I guess nobody never slipped up. We’ll be publishing the entire dump of 557k orders and 862k crypto transaction IDs at the end of May, whether or not you and your customers’ info is on that list is totally up to you. And yes…
YES, THIS IS AN EXTORTION !!!

As for the buyers, we’ll be opening up a whitelist portal for them to remove their records as well in a few weeks.
Thank you all for doing business with Incognito Market”

The message included a list of the "top" vendors who had paid the ransom to protect their customers and themselves. The payments ranged from $100 to $20,000, depending on how many transactions each person had handled. The scam put drug sellers in a tough spot. They didn’t want their business to be exposed to the police, but paying the blackmailers could lead to even higher demands. Where would it end? The amount of information Lin threatened to release was shocking. When Incognito Market shut down, Lin didn’t go away quietly. Instead, he warned users that he had records of over 500,000 orders and more than 860,000 cryptocurrency transaction IDs. He threatened to reveal all the transaction details on Incognito, including the names of buyers and sellers, which could identify people involved in illegal orders. This could put thousands of users at risk of legal trouble. What’s striking is how Lin used this data as a weapon, basically forcing his own users to pay or face legal action. This shows how vulnerable dark web users really are, even if they think they are safe. It’s a warning to anyone who believes their anonymity on such sites is foolproof, especially when the site operator can be the biggest threat.

- Incognito message provided by Battery from DarkNetPedia

Arrest

Lin Rui-siang, a/k/a “林睿庠,” a/k/a “Pharoah,” a/k/a “faro,” admin of Incognito, was arrested at John F. Kennedy Airport on May 18, 2024, and charged with: engaging in a continuing criminal enterprise, narcotics conspiracy, money laundering, and conspiracy to sell adulterated and misbranded medication.

Market links

Rotational URL:

• https://incogbot.io

Market mirror URLs:

• http://incognito2sjotqmbkys7wivkpq7d4a4tkpweoiqefk7mpf7uvyfalad.onion 
• http://incognito75yd2w2qylg7xadz2rd7o2peqt5gcvmd2irxqbqj7c6exid.onion 
• http://incognitolonzsx5xjswcbuchyasvwnq5tqxvmprys2mpopsmyn3p5id.onion
• http://incognitox3vs5grdnmh52k35m64vib5fsbdrxzilujjptiqzeyrxhid.onion
• http://incogniteqtvrg4oydx7rif7yntws5rkhvbqprrbabwwfrmd3j2a.b32.i2p

PGP Key

-----BEGIN PGP PUBLIC KEY BLOCK-----
Comment: Incognite Team (Incognito Market, Antinalysis, Sector.City, Libre)
Comment: 512-bit ECDSA (brainpoolP512r1)
Comment: 8478CA0C19E4857909951E2D2FBD296627CEC6EA


mJMEX7W+sRMJKyQDAwIIAQENBAMEDFRakey8hWNTRQTXzmQnv2ccOstImWDWqJKa
HbZg/LfbY96ZRbto09GKMQ2Uf/OWeJPw75ElNbVvw5HbC+1UuRzfcuaM1KW+/7x0
f708DJRsmK619ONXHUXO/yBkJkRnNs2FcvH5H+hhvxC5XrCsm8ALJCc8Q86nb1j8
DSPROxi0CWluY29nbml0b4jWBBMTCgA+FiEEhHjKDBnkhXkJlR4tL70pZifOxuoF
Al+1vrECGwMFCQP59Q8FCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQL70pZifO
xuqCdwH9HzdaYI3IDKAlOe6dyTl9/RCQk20dIjwTw/gPiVlfurngPDUpjKHS2x5W
TgMG8lLYbz7DVxMRBusgcOmEIHG5gwH/b7bwtlrk2corkmU1FwxJo0qnlwi5PsMD
XFSO3U+8J3reFliUhFCf9UvZifoxq5Y2Q2fDaNtE1VGQV0lc5uYpfriXBF+1vrES
CSskAwMCCAEBDQQDBFLjHfc2VE0AaD3DtlJSKG2M5Cpg7QyjxPNB8PRciKD0U5H2
vP+4RYdWjHbXzaNjcZxqMrKNg6ZaZKxFC5iRoDFAKc8ktBnopTRpQyc2IbENSNom
GeJRnUjDicMu9SeI9VEtYZkusQs7gi74ucgER3+qOOJJNqP9lieD4sXE0uYqAwEK
CYi+BBgTCgAmFiEEhHjKDBnkhXkJlR4tL70pZifOxuoFAl+1vrECGwwFCQP59Q8A
CgkQL70pZifOxuqE5AIAqfQw0qQP4915TYFo/urMbtafJws5rqfMD8oLuBQUhjXj
DLkCrbgyQ418uK59lyMB5W+TPoPf3NeAzDS3nL7g8QH/d4RaSXYkaJJNq7/egmmX
K7hdi8O2oLyRIrcgDGWPbHw5ZVNSz754vxWvV+6FhiVX3y2EZx1qG2jWx6ptlKH2
TA==
=BRfZ
-----END PGP PUBLIC KEY BLOCK-----