Loading threat actor…
Luckp 47 Shop is an illicit darknet weapons-market operation that has also used the branding Freedom Shop and the external label Lucky 47 Shop. The operation ran through multiple Tor hidden services over time and appears to have been an ecosystem of related storefronts rather than a single site, with overlapping layouts, reused product imagery, shared contact identifiers, and recurring cryptocurrency payment infrastructure. Archived marketplace content advertised military-style weapons, ammunition, grenades, suppressors, launchers, and tactical accessories, with multilingual support and claimed international shipping. The operation used persistent branding across product photographs and storefront materials, and older archived pages associated the name with the phrase “Luhansk Counter Kiev Partisans,” alongside militarized imagery and references to the war in Ukraine. That branding suggests an attempt to frame the marketplace in conflict-oriented or insurgency-themed terms, but there is no definitive evidence that the operation was tied to a verified militant organization or real-world armed faction. Operationally, the Luckp 47 ecosystem demonstrated repeated reuse of contact infrastructure, cross-site redeployment, and rotating cryptocurrency wallets across successive domains. Older infrastructure showed observable Bitcoin activity over multiple years, often following receive-and-drain patterns, while newer deployments appeared more mirror-like and in some cases showed little or no public transaction activity. The marketplace later expanded payment options beyond Bitcoin to include Ethereum and Monero. References to the operation were also observed on Telegram, indicating underground promotion beyond Tor. Luckp 47 Shop is best characterized as a clandestine illicit-arms marketplace with conflict-themed branding, cryptocurrency-enabled sales workflows, and persistent multi-domain operational continuity. High-confidence evidence supports criminal underground commerce and promotional activity, but not attribution to a state sponsor or authenticated insurgent group.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.