After the Fall: Unpacking Nemesis Market’s Legacy
At its peak, Nemesis Market was more than another darkweb storefront. It was a sprawling, multi-vendor marketplace where tens of thousands of users bought and sold everything from high-purity cocaine and heroin to stolen credit cards, hacking tools, and money-laundering services. By late 2024, the operation had reached over 30,000 active users, 1,000 vendors, and nearly $30 million in illicit sales before being dismantled in a joint law enforcement action spanning the United States, Germany, and Lithuania.
For anyone attempting to revisit it today, Nemesis appears frozen in time, its onion site stripped to a single banner: “Nemesis Market has been Seized.” No listings, no forums, no escrow services. On the surface, it looks like the end of the story.
But beneath that surface, the market’s digital remnants continue to circulate. Using StealthMole, we were able to move past the seizure notice and uncover the traces Nemesis left behind: a tangle of disputed onion mirrors, cryptocurrency wallets both genuine and fake, PGP keys bound to suspicious addresses, and chatter fragments linking vendors, opportunists, and possible customers.
This report is not about exposing an active marketplace. It is about showing how even platforms long considered “dead” can still be unpacked, analyzed, and understood. In doing so, Nemesis Market becomes both a case study of a fallen dark web hub and a demonstration of StealthMole’s ability to trace criminal ecosystems well beyond their takedown.
Incident Trigger & Initial Investigation
The trigger for this investigation did not come from Nemesis itself as the marketplace had already been dismantled. Instead, it surfaced while pivoting through a darkweb directory on an unrelated case. Buried among active onion links was an entry that pointed back to Nemesis:
- http://nemesis****************************************yd.onion/
This was the same domain publicly seized by US, German, and Lithuanian authorities in March 2024. The page displayed nothing but the seizure notice, consistent with its shutdown. Yet, rather than treating it as a dead end, the domain was used as a starting point to test how StealthMole could work against platforms long considered inaccessible.
Running the Nemesis onion through StealthMole immediately returned a broad set of artifacts: Bitcoin addresses, Monero wallets, Telegram channels, Discord invites, CVE references, Tox and Session IDs, and thousands of leaked emails and credit cards. This early result confirmed two things. First, Nemesis Market had operated far beyond a simple drug bazaar, integrating fraud services, hacking tools, and laundering features into its ecosystem. Second, while the live site was gone, its infrastructure footprint still lingered in ways that could be systematically mapped.
From this starting point, the investigation expanded outward: into mirror domains, cryptocurrency trails, suspected administrator posts, and even compromised data links that hinted at possible real-world identities.
Platform Profile
Nemesis Market was structured not as a single-vendor shop but as a full multi-vendor marketplace. Anyone could register as a customer, but the platform also allowed new sellers to apply for vendor status, positioning itself as both a storefront and an ecosystem. This approach helped Nemesis scale quickly, hosting more than 1,000 vendors by the time of its takedown.
Order Workflow
Nemesis operated a formalized order process that mirrored other major markets, but with strict timelines designed to manage disputes:
- Vendors had 5 days to accept or reject an order; if no action was taken, the buyer could cancel after 48 hours.
- Once accepted, vendors had 5 days to ship. If they failed, the buyer was automatically refunded.
- After shipping, customers could not cancel, but had 10 days post-delivery to open a dispute if the order never arrived.
- Buyers could leave reviews only after finalization.
While this structure appeared to protect both sides, in practice it became a source of contention. Customers frequently complained that disputes were closed in favor of vendors, even in cases of clear fraud, fueling Nemesis’s reputation as a marketplace where scams were “part of the business model.”
Product Ecosystem
Nemesis’s listings spanned the full spectrum of dark web commerce:
- Drugs:
Cannabis (over 3,000 listings), stimulants like cocaine and meth, opioids including heroin and fentanyl, benzodiazepines, psychedelics, dissociatives, prescription drugs, steroids, and paraphernalia. - Fraud:
CVVs, fullz, SSNs, hacked accounts, carding guides, bank drops, verified logins, dumps, VPN/RDP access, and identity data. - Hacking:
Malware, botnets, ransomware, phishing kits, DDoS services, exploits, access sales, data dumps, and hacker-for-hire services. - Forgeries & Counterfeits:
Digital/physical documents, counterfeit currency, jewelry, clothing, electronics, artwork, and even deepfake services. - Other:
Cash-to-crypto services, self-defense items, custom orders, and thousands of “how-to” guides and tutorials.
Administration
The site listed two operators in its moderator section:
- Francis — Admin and publicly recognized figure, credited with establishing Nemesis.
- Altia — Moderator.
Francis was also vocal on the Nemesis forum, providing instructions to users, clarifying legitimate payment addresses, and denouncing phishing attempts. His posts form part of the evidence base used to separate authentic Nemesis infrastructure from opportunistic clones.
Infrastructure & Mirrors
Nemesis Market’s digital footprint is complicated by a contradiction at its core. On the one hand, the platform’s administrator, Francis, explicitly stated in forum posts that Nemesis operated from a single onion address and did not maintain mirrors. His warning was direct: any alternate addresses should be treated as phishing attempts. The official site he referenced was:
- http://nemesis********************************************yd.onion/
This was the same domain seized in 2024 by law enforcement, and today it displays only the takedown notice.
Yet, when the seized domain was run through StealthMole, a different picture emerged. Tracker results and Telegram pivots revealed a long list of additional onion addresses tied to Nemesis artifacts. Some of these domains resolved back to Nemesis content during its operation, while others appear to have been opportunistic clones or phishing sites created to capture unsuspecting users.
First Set of Mirrors (via Telegram tracker)
- uw****************************************************id.onion
- r*****************************************************yd.onion
- x6*****************************************************d.onion
- nemesi************************************************ad.onion
- pu5***************************************************yd.onion
- Specific post URL: http://nemesis****************************id.onion/post/53ae8jtouc3xxkzeyvn5
Second Set of Mirrors (from pivot on rpy...)
- rd****************************************************qd.onion
- tx****************************************************ad.onion
- sn****************************************************id.onion
- nemesis***********************************************yd.onion
- x7r***************************************************ad.onion
- vph***************************************************qd.onion
- rk*****************************************************d.onion
- z7****************************************************ad.onion
- zk*****************************************************d.onion
Taken together, these findings illustrate the tension between Nemesis’s official stance and the reality of its broader footprint. According to Francis (the admin), the marketplace maintained only one onion address, and any mirror should be considered fraudulent. In practice, however, StealthMole surfaced more than a dozen alternate domains connected to Nemesis artifacts. Some of these likely functioned as temporary mirrors during the platform’s uptime, while others were opportunistic clones crafted by phishers hoping to exploit confused users.
This duality is important. For investigators, it demonstrates how difficult it is to draw a hard line between legitimate infrastructure and malicious lookalikes in the darkweb economy. For Nemesis’s own users, it meant constant uncertainty: even those who followed links from Telegram or Discord channels risked being funneled into a phishing site masquerading as the market itself. In this way, Nemesis Market’s infrastructure highlights one of the most persistent challenges of dark web operations - the space between what an administrator claims and what the ecosystem actually produces.
Cryptocurrency & PGP Infrastructure
Cryptocurrency was at the heart of Nemesis Market’s operations, and the traces it left behind remain some of the clearest artifacts for attribution. During its uptime, Nemesis officially supported both Bitcoin (BTC) and Monero (XMR), though even within these payment systems, the platform became a target for fraud and phishing.
Bitcoin
Across tracker pivots and user forum posts, a total of 25 Bitcoin addresses were observed in association with Nemesis. Only a handful, however, were confirmed as legitimate. The administrator Francis repeatedly warned users that Nemesis addresses always began with “1”, and that any address starting with “bc1” was fraudulent.
- Confirmed Nemesis addresses (per Francis/forum mentions):
- 1A*******************************G
- 16*******************************s
- 1J*******************************E
- 1F******************************Dk
- 13*******************************v
- 1K*******************************u
- 1D*******************************i (expired)
- Explicitly fraudulent address (per Francis):
- bc1****************************w
The remaining 17 BTC addresses detected by StealthMole were assessed as belonging to customers or phishing actors, not to Nemesis infrastructure itself.
Monero
Three Monero addresses were also recovered, each with different attributions:
- Vendor: 45Y*********************************************************************************************U
- Customer: 46********************************************************************************************X
- Phishing: 43***************************************************************************************n
These addresses demonstrate not only Nemesis’s acceptance of privacy coins but also how quickly its ecosystem was infiltrated by imposters using phishing addresses to mislead buyers.
PGP Keys
In addition to cryptocurrency, Nemesis relied heavily on PGP encryption for vendor verification and communication. Five suspected Nemesis-related email addresses were identified, three of which had active PGP keys.
- b*********s@nemesis.on → 39*************************A
- n*********t@nemesis.sis → 1C*************************3
- s****e@nemisis.com → 0F*******************************6
- l******ne@nemesis.com
- N*********t@gmail.com
The presence of multiple Nemesis-branded emails with PGP fingerprints reflects how the market attempted to build a sense of legitimacy, but also how this infrastructure became a source of noise, some keys appear authentic, while others may have been generated by phishing actors to imitate official staff.
Taken together, Nemesis’s cryptocurrency and PGP footprint tells a story of both scale and fragility. The platform moved millions of dollars in Bitcoin and Monero, but its community constantly battled impersonators and phishing campaigns. Francis’s warnings about fake BTC addresses, coupled with the proliferation of Nemesis-themed emails and PGP keys, show how even at its peak, Nemesis operated in a contested space where trust was tenuous. For investigators, however, these artifacts provide valuable markers: cryptographic anchors that survive long after the marketplace itself was seized.
Community & Scam Activity
Beneath Nemesis Market’s polished storefront and structured order process was a community plagued by distrust. While the platform attempted to enforce rules and dispute procedures, users frequently complained that these mechanisms worked more in favor of vendors than customers.
Vendor Scams
Reports of fraud were widespread. Customers described orders that were never shipped, fake tracking numbers, and disputes closed without proper review. One vendor in particular, Bulkexpress, was repeatedly accused of scamming large orders. Forum posts highlighted that while evidence of fraud mounted, moderators often sided with vendors, leaving customers to absorb the losses. This pattern contributed to Nemesis’s reputation as a marketplace where scams were not an exception, but an ongoing risk.
Role of Moderators
The site officially listed two operators:
- Francis — Admin, publicly visible and often active in forum discussions. He was credited with founding Nemesis and frequently intervened in threads to warn against phishing addresses or clarify official policies.
- Altia — Moderator, less publicly active but named in the site’s mod section.
Francis’s presence shaped much of Nemesis’s community dynamic. On one hand, he was seen as a guiding figure, offering security advice such as warning users to only trust BTC addresses beginning with “1.” On the other, his insistence that Nemesis had “only one onion address” conflicted with the dozens of mirrors circulating across forums and Telegram channels, many of which were later proven fraudulent. This contradiction deepened user skepticism and blurred the line between official communication and opportunistic noise.
The combination of scams, phishing domains, and moderator bias created an atmosphere where even loyal users struggled to know whom to trust. For some, Nemesis offered profitable opportunities as a vendor or reliable access to illicit goods. For others, it was a marketplace defined by risk, where every transaction carried the possibility of being exploited by fraudsters or misled by fake infrastructure.
Traces Beyond the Marketplace
During the course of the infrastructure sweep, one Nemesis-linked onion domain surfaced an email address: e*****s@tuta.io. Its exact role within the marketplace was unclear, however, what gave it significance was how it extended the investigation beyond Nemesis itself and into wider compromised data environments.
- tx3**************************************************ad.onion
When the address was run through StealthMole’s Compromised Data File and Compromised Data Set tools, it appeared alongside a computer username h*****l (ISOBOOT) with an IP address 7*.*0.*5.**8. Further enrichment resolved the IP to precise coordinates in M*****l, C*****a (4*.5***4, -7*.***8). This correlation did not end there. The same machine data also tied to a second email, h*****u.a******d@gmail.com, which appeared in unrelated leaks including the A*******a breach and entries within the C*******n government jobs portal. Some leaked password strings associated with the account also referenced “C******a,” reinforcing the geolocation match.
This sequence illustrates a recurring challenge in dark web investigations: the presence of identity fragments that are technically precise but contextually ambiguous. The overlap between a suspected Nemesis-linked artifact (the tuta.io address) and real-world identifiers in Montreal does not inherently prove administrative or vendor responsibility. Instead, it raises multiple plausible scenarios:
- The individual may have been a customer, whose contact information and system logs intersected with Nemesis during routine use.
- They could have operated as a vendor, in which case their personal identifiers bled into market-facing infrastructure.
- Or they may have been entirely peripheral, with their details scraped, leaked, or repurposed by others inside Nemesis.
What is clear, however, is the investigative value of these traces. Even in cases where attribution cannot be confirmed, connections like this show how darkweb markets act as crossroads, where criminal infrastructure, opportunistic actors, and ordinary users leave overlapping footprints. The Montreal pivot underscores how StealthMole can surface leads that stretch from seized marketplaces into broader ecosystems of compromised data, opening investigative pathways that would otherwise remain invisible.
The Nemesis Aftermath
The dismantling of Nemesis Market in 2024 marked the end of its active operations, but the investigation into its remnants reveals several insights with implications for both law enforcement and the wider understanding of darkweb ecosystems.
First, the case demonstrates how official narratives often diverge from practical realities. While administrator Francis maintained that Nemesis had only one onion address, StealthMole surfaced more than a dozen alternate domains tied to Nemesis artifacts. Some were functioning mirrors, others were phishing clones, but the volume itself illustrates how darkweb markets generate shadow infrastructures that persist long after takedown.
Second, Nemesis’s cryptocurrency ecosystem highlights the dual nature of financial tracing. Of the 25 Bitcoin addresses associated with the platform, only a handful were confirmed as legitimate, while others were explicitly identified as phishing attempts or tied to customers. Similarly, three Monero wallets surfaced, representing vendor, customer, and phishing use cases. This blurred boundary between authentic and fraudulent infrastructure complicated trust for users, but also created clear investigative hooks for post-seizure analysis.
Third, Nemesis’s community dynamics underscore how scams and opportunism corrode darkweb markets from within. Despite its structured order workflow and escrow rules, disputes often ended in favor of vendors, fueling widespread complaints of fraud. This persistent distrust not only damaged Nemesis’s reputation among users, but also increased the number of phishing schemes and fake mirrors exploiting that uncertainty.
Finally, the discovery of traces beyond the marketplace such as emails and IPs intersecting with compromised datasets, shows the potential of extending darkweb investigations into the broader digital ecosystem. While these leads cannot be treated as direct attribution, they provide investigative entry points into individuals whose data intersected with Nemesis activity. For law enforcement, such pivots are valuable for building context around users and vendors without overstepping into unconfirmed identity claims.
In sum, Nemesis Market illustrates how darkweb markets rarely vanish cleanly. Even after seizure, their infrastructure, financial markers, and user traces linger across multiple platforms. For investigators, this persistence is both a challenge and an opportunity: a challenge because noise and phishing obscure clear attribution, but an opportunity because tools like StealthMole can continue mapping ecosystems long after their supposed end.
Conclusion
The investigation into Nemesis Market shows that a darknet platform does not vanish when its servers are seized. Instead, it leaves behind an uneven trail of mirrors, cryptographic keys, payment addresses, and user fragments that continue to circulate long after the takedown. These traces do not rebuild the market, but they do allow investigators to reconstruct how it worked, how it was exploited, and what vulnerabilities defined its community.
Nemesis also highlights the constant overlap between authenticity and deception. The official onion address sat alongside dozens of mirrors, some operational and others designed for fraud. Genuine Bitcoin and Monero wallets were listed next to phishing accounts. Administrators issued warnings while users reported scams that moderators dismissed. This tension between what was real and what was false was not an accident: it was part of the environment Nemesis created and part of the reason it attracted both opportunists and victims.
For StealthMole, Nemesis provided the perfect test case: a platform declared dead, yet still able to yield mirror networks, disputed wallets, and traces of user activity when approached with the right tools.
Editorial Note
As with all dark web investigations, cyber attribution remains probabilistic. Nemesis Market’s footprint illustrates how seized platforms continue to generate uncertainty: official domains coexisted with convincing phishing mirrors, real wallets circulated alongside fraudulent ones, and user data surfaced in leaks without clear ties to role or responsibility. Attribution in such cases depends not on a single artifact, but on identifying patterns of reuse, overlap, and infrastructural convergence that persist even after a marketplace has been dismantled.
Contact us: support@stealthmole.com
Labels: Darkweb Marketplace
.svg)
.svg)
.svg)