The Darknet Affiliate Model: Referral Commissions and Traffic Brokering in 2026

Somewhere around 2021, the darknet stopped being a collection of shops and started being a supply chain. If you want to understand why takedowns barely dent the ecosystem, ignore the market banners and look at how traffic gets routed, how vendors get recruited, and who takes a cut for sending a buyer through the door. The affiliate model is the connective tissue here, and it’s the least covered part of the underground economy.

The referral commission is not new, but the plumbing is

The dark web glossary definition is blunt: an affiliate model is “a business model where operators recruit partners to execute attacks or sales in exchange for a cut of the proceeds.” That was written with malware and fraud in mind, but the same mechanic now sits under marketplace onboarding, initial access brokering, and proxy resale.

Marketplaces historically handled recruitment themselves. A new shop launched, admin posted on Dread or a Telegram channel, vendors migrated over. Slow, manual, reputation-dependent. The mature version in 2026 outsources that. Affiliates, sometimes called partners or referrers, push traffic toward a storefront and take a percentage of whatever converts.

This is not a guess about intent. It’s visible in the same infrastructure economy that sells everything else as a service. The 2026 Chainalysis Crypto Crime Report figures cited by SOS Intel put global underground economic activity at roughly $3.2 billion, with criminal-as-a-service offerings alone worth about $700 million. Affiliate commissions are a distribution cost inside that $700 million, and they’re cheap relative to running your own acquisition funnel.

Why the script economy made affiliates inevitable

You can’t run a referral program without something to refer to. That problem got solved by marketplace-as-a-service.

SOS Intel’s crawl of dark web markets found a single Tor-hosted storefront trading as “Darkweb Developer,” selling turnkey marketplace scripts for at least eighteen months. The Incognito Market script was listed at $1,000, discounted to $750 when captured. Scripts ship with version numbers, feature lists, update cycles, and technical support.

That’s the important part. When the storefront software is a commodity product, the operator’s actual business is customer acquisition. And acquisition at scale means affiliates.

It also explains the count paradox that has puzzled intelligence teams for years: why 35 to 45 distinct marketplaces coexist despite constant seizure activity. They aren’t independent ecosystems. They’re deployments of a handful of scripts, run in isolation with minimal customisation. Franchise economics, essentially. Each instance needs traffic. Each instance will pay for it.

The Genesis Market precedent

The Genesis Market seizure in 2024 is the cleanest illustration of why this matters. The expectation was that it would vanish. Within weeks, a clone was operating under a different name on a different server.

You don’t get that kind of continuity from a bespoke operation rebuilt from scratch. You get it from a script, a hosting arrangement, and someone who already knows how to route buyers to a new domain. Referral networks are the routing layer that makes the swap nearly invisible to the end user.

Traffic brokering: the proxy reseller case is the tell

The clearest documented affiliate structure in recent enforcement isn’t on a marketplace at all. It’s residential proxies.

Google’s Threat Intelligence Group and the FBI seized the NetNut proxy network, which monetised infected consumer devices by renting their connections to paying customers. The part worth studying is the reseller program.

Several proxy services that appeared independent were NetNut resellers. Same backend infrastructure. Different branding. Google’s team noted this specifically: criminal operators who believed they were buying from an independent provider may have been routing through NetNut infrastructure without knowing it.

That is an affiliate model with a rebranding layer on top. The upstream operator supplies the asset. The reseller supplies the customer relationship and the brand. The customer often has no idea who’s actually upstream. When enforcement hits, the reseller relationships extend the footprint of the takedown in ways that the headline name doesn’t capture, and they also complicate rebuild attempts by smaller operators.

How much traffic is actually moving

In a single representative week in June 2026, Google counted 316 distinct threat clusters using suspected NetNut exit nodes to mask location, run password-guessing attacks, and evade IP-based detection.

That’s not one organisation. That’s a cross-section of the global threat actor community buying proxy access as commodity infrastructure, often through a reseller layer that obscures the origin.

Affiliates in the ransomware chain

Ransomware-as-a-service is the affiliate model most people already know, and the academic literature is worth reading because it complicates the hype.

A two-year netnographic study of darknet markets and forums found that RaaS is a modest threat relative to popular opinion. Compared to other categories of illegal digital goods, there are relatively few RaaS listings, and their authenticity is often questionable. The researchers built a value chain and actor descriptions from that data.

So the affiliate layer exists, but the storefront inventory is thinner and shakier than the media narrative suggests. That’s a useful correction. Affiliate programs in ransomware look less like a mature franchise and more like a noisy, scam-heavy marketplace with a few real operators and a long tail of people selling access to nothing.

The genuinely efficient part is one step upstream. Rather than run the full attack lifecycle, many ransomware affiliates buy pre-established network access from initial access brokers. IABs compromise organisations through vulnerable systems, phishing, or credentials from infostealer malware, then sell that access on underground forums. Listings get priced by victim revenue, access type (VPN, RDP, Active Directory), and geography.

That division of labour is the affiliate model stripped to its bones. The IAB does acquisition. The affiliate does execution. Everyone takes a slice. The technical barrier to entry for a ransomware attack drops to roughly the price of a VPN credential and the patience to use it.

What brokers actually get paid, and what we don’t know

Here’s where I have to be honest about the evidence gap. Public reporting establishes that referral and reseller arrangements exist, and it establishes their function. It does not give reliable commission percentages for marketplace affiliates in 2026. Anyone quoting a precise rate is either working from private telemetry or making it up.

The proxy case is the exception because the model is commercial rather than criminal-first: resellers bought access to a pool and rebranded it. That’s a wholesale arrangement, not a per-conversion referral. Different mechanic, same logic.

For marketplaces, the affiliate cut almost certainly tracks the escrow economics. Abacus Market, which rebranded from an earlier name in November 2021, ran the standard stack: Tor access, cryptocurrency payments, escrow. Escrow means the platform holds funds and takes a fee at settlement. An affiliate commission would come out of that same fee, paid for bringing in a buyer who completes a transaction. That’s the structure. The rate is unknown.

Why this breaks the takedown playbook

When a marketplace closes, its vendors and buyers don’t disappear. They migrate. Whichever platform absorbs that migration becomes dominant almost overnight. Abacus’s growth came less from its own product than from a series of rival collapses feeding it users.

Affiliate networks accelerate that migration. A broker with an audience can redirect it in a day. The audience doesn’t need to trust the new brand, because they trust the broker.

This is why enforcement alone can’t disrupt the underground, and why the more useful defensive priority sits with infrastructure and services. Seize the storefront and you’ve seized one deployment of a $750 script. The referral relationships, the hosting, the proxy pool, and the IAB listings all survive the event.

The 38-plus active marketplaces counted as of 2020 were never 38 independent businesses. They were instances. In 2026 they’re instances with paid distribution.

The forensic angle: where affiliates leave traces

If you’re doing threat intelligence rather than shopping, affiliate structures are actually a gift. They create linkage that pure market analysis misses.

• Shared backend fingerprints. The NetNut case showed that rebranded resellers shared the same underlying infrastructure. Find the backend, enumerate the brands.
• Script version artefacts. Marketplace instances built from the same commodity script carry the same UI quirks, update cadence, and feature gaps. That’s a clustering signal.
• Referral funnels. Brokers who route traffic tend to route it to multiple destinations. A single broker pointing at three storefronts links those storefronts operationally.
• IAB pricing patterns. Access listings priced by revenue band, access type, and geography create a queryable market signal, and the same broker handle often appears across forums.

None of this is novel tradecraft. It’s just rarely applied to the affiliate layer specifically, because most teams orient around marketplace content rather than marketplace plumbing.

Practical reality check

Two things worth saying plainly before anyone gets excited about this as a research direction.

First, the marketplaces themselves offer no user protection and can be closed at any time. That’s true of every instance, script-based or not. Affiliate polish doesn’t change the underlying risk profile.

Second, the affiliate layer is where the scam density is highest. A broker monetising referrals has no stake in whether the destination marketplace pays out. The incentive is to drive volume, not to vet. Some of the “independent” storefronts being promoted are reseller fronts for infrastructure that gets seized, or exit scams waiting for the right moment.

That’s not a warning aimed at buyers, who shouldn’t be there. It’s a note for analysts: when you see a sharp traffic spike toward a newly branded marketplace, check whether it’s an affiliate push before you treat it as organic vendor migration. The two look similar in the data and mean very different things.

Research only. Nothing here is access guidance, and no live markets are linked or named as destinations. Handle any related artefacts in an isolated environment.