Infrastructure Analysis of CaLA, a Japanese-Language Dark Web Drug Marketplace
By Threat Intelligence Unit
Executive Summary
- CaLA, a Japanese-language marketplace facilitating the sale of cannabis and psychedelic drugs in Japan, was analyzed across its Tor and Clearnet infrastructure
- The marketplace was confirmed to be accessible through both Tor and Clearnet infrastructure
- Infrastructure analysis showed that the service remains active, with recently published listings and operational vendor activities
Site Analysis
CaLA is a Japanese-language marketplace dedicated to the sale of cannabis and psychedelic drugs within Japan. The marketplace operates through both Tor and Clearnet domains.
Access Information
Onion Domain: vfpxobzedslkmagymsdeuv3sw4bo65wj5u6epoogtwwyvpmf4kadvhad.onion
Clearnet Domains:
cala[.]oneapi.cala[.]onecommunity.cala[.]onevendor.cala[.]onemarket.cala[.]one
During the investigation, the marketplace remained accessible through both the Onion service and its associated Clearnet domains.
Figure 1. CaLA website interface
The marketplace supports multiple vendors offering illegal drugs.
The available product categories include:
- Hashish
- Cannabis Concentrates
- Sativa
- Indica
- Hybrid
- Cannabis Vape Liquid
- Cannabis Buds
- Edibles
- Magic Mushrooms
- LSD
- DMT
Figure 2. Names of product categories
These categories primarily consist of cannabis and psychedelic products.
Figure 3. Product categories offered by the marketplace (1)
Figure 4. Product categories offered by the marketplace (2)
According to information published by the operators, CaLA originally began as an online chat community supporting discussions related to cannabis legalization in Japan. It later evolved into an anonymous marketplace where users can exchange information and trade cannabis-related products.
The community claims to have operated for approximately seven years since 2019. Although the exact launch date of the marketplace itself could not be independently verified, the stated operational period aligns with publicly available domain registration information.
Figure 5. Information about CaLA and its history
Infrastructure Analysis
Public IP Identification
The public IP infrastructure associated with CaLA was identified through Oasis Security's dark web intelligence service Arthur.
- Public IP Address:
185.165.169[.]100 - Country: Romania
- Hosting Provider: FlokiNET-Romania
- ASN: AS200651
The associated Clearnet domains remained accessible through a standard web browser.
Domain Information
| Field | Value |
|---|---|
| Domains | cala[.]oneapi.cala[.]onecommunity.cala[.]onevendor.cala[.]onemarket.cala[.]one |
| Registrar | Tucows Domains Inc. |
| Created | August 15, 2019 |
| Updated | March 4, 2026 |
| Expires | August 15, 2027 |
| Name Server Provider | 1984 ehf |
| TLS Certificate Authority | Let's Encrypt |
| Certificate Validity | June 21, 2026 – September 19, 2026 |
Figure 6. CaLA website interface through public IP
Search-Indexed X Post
Indexed search results referenced a previous X (formerly Twitter) post promoting the marketplace as a service where cannabis products could be purchased continuously.
- Tweet ID:
2040862856304799807 - Posted: April 6, 2026 (JST)
The post stated that CaLA was celebrating its seventh anniversary, suggesting that the service had been operating since 2019. This information is consistent with both the operational history published on the marketplace and the domain registration timeline.
However, the original X post was no longer accessible during the investigation, and neither the publishing account nor its operator could be verified.
Figure 7. Indexed search result describing the marketplace’s continuous product availability
Marketplace Activity
Analysis of 49 marketplace listings indicated ongoing activity.
The earliest observable listing was published approximately four months before the investigation by the vendor idoloveweed.
Figure 8. Product listed by idoloveweed
The most recent listing had been published approximately one hour prior to analysis by the vendor ANima Fram, indicating that illegal drug sales remained active.
Figure 9. Product listed by ANima Fram
Another listing published approximately 23 hours before the investigation referenced the restricted community channel hosted at community.cala[.]one/cala/channels/132
Figure 10. Listing referencing restricted community channel
This suggests that CaLA operates a separate administrator-approved community platform used for communication and information sharing among members.
Figure 11. Administrator-approved community platform interface
Buyer and Vendor Operations
The marketplace provides separate procedures for buyers and vendors.
Buyers can purchase products using Bitcoin (BTC), Monero (XMR), or Litecoin (LTC). Delivery tracking is available through an integrated Telegram bot.
Figure 12. Procedures for buyers and vendors
Vendor registration is performed through:
vendor.cala[.]one
The marketplace does not require identity verification (KYC). Vendors can register using only a vendor name, user ID, and password.
Figure 13. Marketplace account registration requiring only a username and password
Figure 14. Vendor registration form requiring only a brand name, username, and password
To activate a vendor account, a security deposit of ¥50,000 must be transferred to a cryptocurrency wallet generated by the operator. The payment address changes for each registration session.
Figure 15. Security deposit transfer options
Telegram Services
CaLA operates dedicated Telegram services supporting marketplace operations.
- Official Inquiry Channel:
@calaofficial - Delivery Tracking Bot:
@CaLA1bot
The Telegram bot can be linked through the buyer account settings page after registration and is used for delivery tracking and purchase management.
Figure 16. Official Telegram inquiry channel and delivery tracking bot operated by the marketplace
Conclusion
Analysis of CaLA, a Japanese-language dark web marketplace specializing in cannabis and psychedelic drugs, was conducted using Arthur to examine the marketplace's infrastructure and ongoing operations.
The analysis confirmed that CaLA remains operational across both Tor and Clearnet infrastructure, with active product listings, vendor registration, cryptocurrency payment services, and associated communication channels. Arthur also provided visibility into the public infrastructure associated with the marketplace, highlighting operational components exposed outside the Tor network.