Mirrors of Free City: Investigating the Chinese Marketplace Across Dark & Deep Web

The Chinese-language dark web ecosystem rarely attracts the same public attention as ransomware gangs or leak sites operating in Western underground communities, yet it remains one of the most active and fragmented underground environments online. Spread across Tor hidden services, Telegram channels, automated bots, and constantly shifting mirror domains, these networks operate through tightly connected ecosystems that are often difficult to map from a single entry point.

Over the past few years, Telegram has become increasingly intertwined with these underground operations. What once existed primarily through standalone onion marketplaces has gradually evolved into interconnected communities where advertisements, escrow services, account support, mirror updates, automated replies, and underground promotions all move through Telegram in parallel with dark web infrastructure. In many cases, Telegram acts as both a communication layer and a resilience mechanism, allowing marketplaces to survive domain instability, takedowns, or operational disruptions.

Unlike highly publicized Western marketplaces that frequently rely on reputation through media exposure, many Chinese-language underground platforms grow through closed communities, repost networks, bot automation, and cross-channel promotion. The result is an ecosystem that feels less centralized and more adaptive, where infrastructure constantly shifts while the surrounding network remains active.

This operational model makes investigations significantly more challenging. A single Telegram channel can lead to multiple onion mirrors, bot accounts, administrative channels, escrow systems, and interconnected services spread across different platforms. What initially appears to be a single marketplace often reveals a much broader infrastructure designed to maintain persistence and visibility even as domains rotate or services disappear.

Incident Trigger and Initial Investigation

The investigation began while reviewing unrelated Chinese-language dark web activity, where an onion domain repeatedly surfaced during routine monitoring:

• anwan*****************************************ruyd.onion

At first glance, the site looked different from many short-lived or poorly maintained onion marketplaces that frequently appear across underground forums. The platform, operating under the name “自由城” (“Free City”), presented itself as a structured anonymous escrow marketplace and community forum rather than a simple storefront or leak page.

The marketplace interface suggested an active and relatively organized ecosystem. Visible sections referenced digital goods trading, underground services, anonymous transactions, and community-based activity tied to Telegram. Several marketplace categories also appeared geographically segmented through province-based filters, something more commonly seen in Chinese-language underground communities than in Western-facing darknet markets.

What made the platform particularly interesting during the initial review was the way it blended multiple functions into a single environment. Alongside marketplace listings, the site promoted escrow-style transactions, community interaction, and external communication channels, giving the impression that the platform operated as part of a larger ecosystem rather than a standalone onion site.

The marketplace also appeared unusually persistent. Historical snapshot data indicated that the domain had been observed for several years, a notable detail considering how frequently underground marketplaces disappear due to operational instability, scams, or infrastructure takedowns.

Expansion of the Free City Infrastructure

To better understand whether Free City operated as an isolated marketplace or part of a larger network, the original onion domain was further investigated using StealthMole’s Darkweb Tracker. The results quickly suggested that the platform maintained additional infrastructure beyond the initially identified marketplace.

The first notable discovery was the identification of two associated onion domains connected to the original Free City marketplace:

• freecitvpzyu2dwmnak5fzuasowmkswxbknh7oj3i4recf4nj4nqdpqd.onion
• xbtpp***********************************************fjyd.onion

The freecit naming convention immediately stood out because it directly aligned with the platform’s “Free City” branding. Although the domain appeared inactive, it suggested that the marketplace may have operated through earlier infrastructure before transitioning to newer onion services.

In contrast, the xbtppbb domain remained active and displayed a marketplace interface visually similar to the original Free City site, including matching layout structures, forum-style navigation, and escrow-related terminology.

At this stage of the investigation, Free City was already beginning to resemble a marketplace operating through layered infrastructure rather than a single standalone onion service.

Further investigation into related infrastructure uncovered two additional onion domains:

• anwangokadzm5drfhz4464slrnhtsxnztyaqkujct5xrznqlqy2utuyd.onion
• xbtppbb7xdqdiebess2nsxagae3tcelr3tfqo6sgjvtpb7tvibl665qd.onion

The repeated appearance of the anwangok and xbtppbb naming patterns became increasingly significant as the investigation progressed. Both domains continued to display similar marketplace branding, registration pages, login portals, and forum-oriented navigation structures associated with Free City.

The infrastructure pattern became even more apparent after another related onion domain was identified:

• anwangok3embyqisu6i7fip6dex74hzhf72llqs7eyfi6h2yo4xlnwyd.onion

By this point, the repeated use of the anwangok prefix across multiple domains no longer appeared coincidental. Instead, the infrastructure suggested deliberate domain rotation or mirror deployment designed to preserve accessibility and operational continuity across the marketplace ecosystem.

Historical snapshot data further reinforced this pattern. Some identified domains appeared to represent older or inactive infrastructure, while others remained operational and actively accessible. Rather than relying on a single persistent onion service, Free City appeared to maintain multiple entry points capable of supporting the broader marketplace environment over time.

As additional domains were identified, the infrastructure surrounding Free City increasingly reflected the operational behavior commonly observed in more mature underground ecosystems, where mirrored services and rotating access points are used to reduce dependence on any single domain and maintain resilience against instability or disruption.

Telegram Ecosystem and Operational Coordination

As the infrastructure investigation expanded, it became increasingly difficult to separate the Free City marketplace from its Telegram presence. Multiple references embedded within the marketplace environment pointed toward a broader communication network operating alongside the onion infrastructure, suggesting that Telegram played a central role in maintaining visibility, coordination, and user engagement across the ecosystem.

The first major pivot came through the Telegram channel:

• https://t.me/free*******l

The channel described itself as an official Free City escrow trading community and contained direct references to the marketplace’s onion infrastructure. Unlike temporary promotional channels often seen around underground services, the channel appeared structured and actively maintained, functioning as a central hub connecting users to marketplace activity, announcements, and related services.

Further investigation into the ecosystem identified several additional Telegram channels and administrative accounts associated with the platform:

Associated Telegram Infrastructure

• https://t.me/free********l
• https://t.me/free********m
• https://t.me/free********n
• https://t.me/free********y
• https://t.me/free********e
• https://t.me/free********t

The naming conventions and channel structure suggested a deliberate separation of operational functions. Some channels focused on announcements and marketplace updates, while others appeared dedicated to tutorials, community discussions, or scam-related exposure content tied to the broader underground ecosystem.

Additional confirmation of these relationships emerged after a leaked text file referencing the original Free City onion domain was identified during the investigation. The file contained several of the same Telegram references connected to the marketplace. To better organize the findings, the file was further analyzed using StealthMole’s MoleChat capability, which extracted multiple recurring identifiers associated with the platform.

Identified Platform References

• Admin account: @free*****n
• Community channel: @free*******l
• Announcement channel: @free*****m
• Tutorial channel: @free******y
• Scam exposure channel: @free*****e

The investigation became more revealing after activity connected to @free****y was reviewed through Telegram Tracker. One screenshot linked to the channel was found circulating within another Telegram community:

• https://t.me/e****1

The channel focused on scam exposure and underground disputes, introducing a different perspective on the Free City ecosystem. Discussions and reposted screenshots referenced marketplace-related conflicts, allegations involving transactions, and broader reputation issues connected to underground activity surrounding the platform. While these discussions did not independently confirm fraudulent activity by Free City itself, they demonstrated that the marketplace had become visible enough within underground communities to generate external discussion, criticism, and monitoring.

Further investigation into Telegram activity connected to the original onion domain revealed repeated marketplace references across multiple Chinese-language underground communities. The marketplace was frequently discussed alongside Tor access instructions, anonymous escrow services, underground resources, and darknet-related community activity. Over time, these references painted a clearer picture of how Free City maintained visibility beyond its onion infrastructure alone.

One of the more significant findings during this stage involved the account:

• @free******n

The account repeatedly appeared in forwarded messages, announcement activity, and marketplace-related discussions connected to the ecosystem. Administrative posts referenced platform upgrades, changes to deposit and withdrawal thresholds, marketplace maintenance, and search-related functionality tied to Telegram groups and channels. These operational announcements suggested ongoing administrative management rather than an abandoned or purely automated marketplace environment.

The investigation also revealed the presence of:

• @Free*****t

Unlike standard promotional accounts, the bot appeared integrated into the broader ecosystem and was repeatedly linked alongside marketplace references, onion domains, and associated Telegram channels. Activity connected to the bot included automated marketplace promotion, reposted advertisements, and ecosystem-related messaging distributed across Telegram communities.

Telegram no longer appeared to function merely as a promotional layer surrounding the marketplace. Instead, it operated as a parallel operational environment supporting communication, announcements, ecosystem coordination, automated activity, and continued marketplace visibility even as onion infrastructure evolved over time.

Marketplace Activity and Ecosystem Behavior

As more infrastructure and Telegram activity surrounding Free City was identified, the marketplace itself began revealing a broader picture of the ecosystem it was supporting. The platform no longer appeared limited to a narrow cybercrime marketplace or isolated escrow service. Instead, Free City functioned more like a multi-layered underground environment where marketplace activity, community interaction, and service promotion existed side by side.

Marketplace categories and promotional content observed during the investigation referenced a wide range of underground activity, including:

Observed Marketplace Themes

• Digital goods trading
• Escrow-based anonymous transactions
• Account trading and virtual resources
• Data-related services
• Telegram-linked underground communities
• Fraud-related marketplace activity
• Underground tutorials and resource sharing
• Regionally segmented marketplace listings

Several marketplace sections appeared geographically organized through province-based filtering, an operational detail more commonly associated with Chinese-language underground communities than broader international darknet markets. The marketplace interface also blended forum-style interaction with listing-based marketplace activity, allowing users to move between advertisements, discussions, and service-related content within the same environment.

As Telegram activity surrounding the ecosystem was further reviewed, recurring references to marketplace behavior and platform reputation also began surfacing across unrelated underground communities. Some discussions described Free City as a long-running anonymous escrow marketplace, while others referenced withdrawal problems, disputed transactions, or operational distrust connected to the platform.

The investigation also revealed that parts of the ecosystem appeared heavily dependent on reposting and cross-channel propagation. Marketplace advertisements, onion domains, automated bot messages, and promotional material frequently circulated across Telegram groups focused on darknet activity, underground resources, fraud exposure, and anonymous marketplace services. This distribution pattern made the ecosystem appear less centralized and more adaptive, allowing marketplace visibility to persist even outside Free City’s directly associated channels.

Conclusion

What initially appeared to be a single Chinese-language onion marketplace gradually revealed a much broader operational ecosystem built across mirrored infrastructure, Telegram communities, administrative channels, and automated bot activity. As the investigation progressed, Free City consistently demonstrated patterns associated with more mature underground environments, particularly through its use of multiple onion domains and Telegram-based coordination.

The investigation also highlighted how closely Telegram and Tor infrastructure now operate together within parts of the Chinese-language underground ecosystem. Marketplace visibility, announcements, escrow-related communication, and promotional activity were no longer confined to hidden services alone, but instead distributed across interconnected Telegram channels and repost networks that helped sustain the platform’s presence over time.

At the same time, the fragmented nature of these ecosystems made attribution and infrastructure mapping significantly more challenging. Marketplace references, mirrored domains, automated activity, and community discussions frequently overlapped across unrelated underground spaces, making it difficult to separate direct operational infrastructure from broader ecosystem noise without continuous pivot-based investigation.

Although Free City appeared to function as an anonymous escrow marketplace and underground community platform, the investigation ultimately demonstrated something larger: modern underground marketplaces increasingly survive not through a single hidden service, but through distributed ecosystems designed to maintain visibility, continuity, and resilience across multiple interconnected platforms.

Editorial Note

Investigations involving dark web marketplaces and underground Telegram ecosystems rarely produce perfectly linear attribution. Infrastructure changes constantly, domains rotate, and unrelated activity often overlaps within the same underground spaces. This investigation demonstrates how StealthMole’s ability to pivot across onion infrastructure, Telegram activity, leaked data, and automated ecosystem indicators can help connect fragmented findings and provide broader visibility into underground networks that would otherwise remain difficult to map.

To access the unmasked report or full details, please reach out to us separately.

Contact us: support@stealthmole.com