Czech law enforcement seized Atlayo, a so-called “Tor social network,” as part of an investigation into darkweb drug traffickers in Denmark.
A seizure banner on the site’s homepage credits law enforcement in Denmark as well as in the Czech Republic with the investigation that resulted in the seizure of the Atlayo domain.
Atlayo, according to the author of a blog post on Secrets of the Dark, is “a social media site on Tor which emphasizes free speech and anonymity.”
Its UI looks a lot like Facebook’s, which isn’t uncommon with these Tor social networks. Like Facebook, it has a chat feature, groups, pages, etc. The main difference is that most people don’t use their real names, and people’s interests seem to center around certain things: hacking, coding, anarchy, and sometimes things like self-harm.
Users could access Atlayo over Tor using the onion address atlayofke5rqhsma.onion or through atlayo.com. Additionally, Atlayo operated its own search engine at xvwhmrw3sgwwmkko.onion. Both onion services are offline and atlayo.com has little to no function beyond displaying a seizure banner.
Some Atlayo users, according to the Copenhagen Police, created Facebook-like groups that functioned as storefronts for various drug vendors.
According to an inspector with a special investigative unit of the Copenhagen Police, drug users purchased a total of 4.5 kilograms of cocaine, three kilograms of MDMA, five kilograms of methamphetamine, 3,500 ecstasy pills, and 40 kilograms of cannabis through the social network.
Authorities arrested two Roskilde residents—a 23-year-old and a 29-year-old—in connection with the investigation into Atlayo. Both men have been accused of creating and operating the social network. A police inspector revealed, during a hearing for the two suspects in police custody, that the Copenhagen Police had identified one more suspect. It appears as if the police have not yet arrested the third suspect and his role in the administration of Atlayo is currently unknown.
Copenhagen Police led the investigation in Denmark and the National Drug Headquarters assisted in the Czech Republic. According to Berlingske, a Danish newspaper and media outlet, Atlayo was hosted on servers in Czechia (and is currently hosted at Wedos, one of the largest webhosts and domain registrars in the country). The A record for atlayo.com changed on June 5, 2020—the date authorities took control of the site. The full extent of the National Drug Headquarters’ involvement is unknown.
“I don’t know how much money they got out of it or if that is necessarily the motive. In this environment you meet many kinds of people who have different motives,” Deputy Police Inspector Torben Henriksen with the Copenhagen Police told Berlingske.
The Atlayo case is notably the first of its kind for Danish police; it is the first drug-related onion service shut down by law enforcement in Denmark. They have taken other onions offline, though, including sites promoting child sexual exploitation.
Authorities in Denmark have been arresting suspected users of Atlayo (for alleged drug crimes) for several months now. They arrested seven suspected users since February 2020. And an investigation into the social network’s users is ongoing.
