Cebulka Darknet Market Mirror-2: Technical Anatomy of a Polish-Language Gateway

Cebulka Mirror-2 is the current stable entry point to one of the few remaining Polish-language darknet markets. While international headlines focus on the large English-language bazaars, this medium-sized forum-style marketplace quietly serves a regional clientele that values domestic postage times and linguistic familiarity. The mirror numbering tells its own story: each increment reflects a Tor hidden-service relocation forced by DDoS, law-enforcement pressure, or hosting failures. Mirror-2 has held steady for roughly four months—long enough for vendors to refresh their PGP keys and for buyers to rebuild browser bookmarks.

Background and Evolution

Cebulka (Polish for “onion bulb”) began as a small invite-only board in late 2019, spun off from a defunct regional forum that imploded after an exit scam. The original admins kept the community structure—sub-boards for different product classes, threaded discussions under each listing, and a shared wiki for tutorials—instead of migrating to the more common Amazon-style storefront. Mirror-1 disappeared in March 2023 when the host node was seized in an unrelated operation; within 72 h the team pushed Mirror-2 to a fresh .onion, signed the new address with the old staff PGP key, and reused the same vanity first eight characters so that seasoned users could recognize the genuine service at a glance. That continuity ritual has become a trust signal in the Polish scene: if the first eight characters change, assume phishing.

Features and Functionality

The market runs on a lightly modified version of the open-source “Flea” codebase (v0.9.4), which means seasoned darknet shoppers will recognize the layout: left-column category tree, center panel with pinned “serious vendors,” and a right-side ticker of recent purchases. Polish speakers appreciate the fully localized interface, including colloquial status tags such as “w drodze” (en-route) instead of the standard “shipped.” Core features include:

Traditional escrow with a 14-day auto-finalize clock, extendable once for another 14 days
Optional “finalize-early” (FE) status for vendors who have completed 200+ orders with <2 % dispute rate
Built-in coin-mixer that forwards deposits through two intermediary wallets before crediting the internal account; mixer fee is 1.5 % for BTC, 0.8 % for XMR
Two-factor authentication via TOTP or PGP challenge–response; the latter is still preferred by older vendors
Per-listing discussion threads that remain visible after purchase, creating a searchable knowledge base about stealth methods, packaging quality, and regional postal quirks

Security Model

OPSEC assumptions on Cebulka Mirror-2 are conservative. The server insists on TLS 1.3 inside the Tor tunnel, pinning its certificate to prevent rogue exit-node sslstrip attempts. All wallet addresses are generated on the fly using an HD seed stored on an offline signing box; the hot frontend never sees the private keys. When a buyer starts a dispute, staff request a PGP-signed statement from both parties, then re-encrypt the evidence bundle with the market’s own key before storing it for 30 days. After 30 days the bundle is wiped—even if law enforcement later gains access, the historical messages are gone. Vendor bond is fixed at 0.05 XMR (roughly €7), low enough to encourage regional sellers but high enough to deter throwaway scam accounts. Notably, the bond is burned rather than refunded if an admin determines that the vendor was fencing phishing clones; that policy has kept fake PDF “vendors” to a minimum.

User Experience

First-time visitors landing on Mirror-2 are greeted by a sober, almost minimalist login page—no animated banners or intrusive captchas. The captcha is hidden behind a small “Rozpocznij” button, a subtle anti-bot measure that cuts down on credential-stuffing noise. Once inside, the search bar accepts Polish diacritics, a nicety that many international markets ignore. Filters for voivodeship (province) let buyers sort listings by domestic shipping distance, effectively prioritizing next-day delivery zones. The wallet page displays both BTC and XMR balances in real time, but a polite red banner reminds users that “Monero = mniejszy ślad” (Monero = smaller footprint). Withdrawals require clicking a confirmation link sent via auto-encrypted onsite message, adding a small speed bump that has saved more than one user from fat-finger address typos.

Reputation and Trust Signals

Cebulka’s community is small enough that reputation paths are short. A vendor with 300 completed sales is considered a veteran; anything above 1 000 earns the “Stary wyjadacz” badge that appears beside the username. Buyers accrue “karma” points for leaving timely feedback and for uploading photos that prove arrival; karma does not unlock discounts, but it does push their reviews to the top of the thread, giving helpful contributors more visibility. The market publishes a monthly transparency report—PGP-signed, of course—that lists the number of new vendors, total escrow held, and dispute resolution rate. Mirror-2’s report for April showed a 3.2 % dispute rate, slightly better than the 4 % industry average calculated by DarknetLive.

Current Status and Reliability

Mirror-2 has maintained 96 % uptime over the past 120 days according to independent onion monitors. Most downtime lasts less than 20 min and coincides with scheduled Tor daemon restarts. The biggest stress test came in early May when a rival forum launched a sustained 3-day Layer-7 DDoS; Cebulka responded by rate-limiting new sessions to one every 10 s and temporarily disabling the public wiki. Order processing slowed but never halted, and no funds were lost because the hot wallet was already empty—withdrawals are processed manually twice per day. Phishing clones still appear, usually registering similar-looking onions that swap a single character. Staff combat this by publishing a fresh PGP-signed mirror list every Monday; experienced users verify the signature against the old key before updating bookmarks.

Practical Guidance for Observers

If you are studying Cebulka for research, treat it like any other Tor hidden service: boot Tails 5.13 or later, set the security slider to “Safest,” and create a dedicated PGP key pair that is never reused for personal email. Download the market’s public key from three independent sources—preferably one from the old Mirror-1 signed message, one from the current mirror, and one pasted by a trusted vendor in a different forum—and cross-check the fingerprints. When funding your wallet, send XMR straight from a local node or a privacy-respecting light wallet; avoid BTC unless you enjoy the extra tracing homework. Finally, remember that Polish domestic mail is fast—often 24 h—so finalize only after you have physically inspected the package. Early finalization removes your only leverage if the product is short-weight or damaged.

Conclusion

Cebulka Mirror-2 is not revolutionary; it is simply a well-maintained regional market that understands its audience. Low fees, Monero-first accounting, and a tight-knit feedback culture make it functional, while the small geographic scope limits the kind of multimillion-euro exit scams that plague global giants. The trade-off is shallower inventory and fewer cutting-edge features such as per-order multisig or Lightning deposits. For Polish-speaking buyers who value quick domestic delivery and can tolerate a limited catalog, Mirror-2 remains a dependable option. For everyone else, it is a useful case study in how localized communities keep the old forum model alive long after the larger playgrounds have switched to slicker, but arguably less transparent, storefront code.