But there's something new being sold on those sites and elsewhere on the internet: counterfeit U.S. money.
A new hacker, who goes by the name of "Mr. Mouse," is selling the fake bills, calling them "Disney Dollars." He was spotted by computer security blogger extraordinaire Brian Krebs, who writes:
Judging from images of his bogus bills, the fake $100 is a copy of the Series 1996 version of the note - not the most recent $100 design released by the U.S. Treasury Department in October 2013. Customers who've purchased his goods say the $20 notes feel a bit waxy, but that the $50s and $100s are quite good fakes.
... I checked with the U.S. Secret Service and with counterfeiting experts, none of whom had previously seen serious counterfeit currency marketed and sold on Internet crime forums.
Krebs goes into detail about how this hacker advertises these fakes as able to pass all sorts of anti-counterfeiting tests including the watermark, the pen test, and the security strip.
But Mr. Mouse is being so bold that he's also advertising on Reddit, Krebs reports, with an ad that anyone can see. Most of the underground sites are not readily available to the casual internet surfer. You have to know how to access them through something called the "Deep web."
We'll see how long that lasts. The U.S. government doesn't take kindly to counterfeiters. Getting caught could land Mr. Mouse in prison for up to 20 years. In the meantime, small-business owners should be extra dutiful about checking for bad bills.
Here's the ad posted on Reddit.
